CVE-2026-25567

Katalog CVE

CVSS 4.3 · Medium EPSS 0,38%

Kerentanan Authorization Bypass Through User-Controlled Key pada wekan project wekan. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.

Rincian

Terbit di NVD

7 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wekan/wekan/commit/67cb47173c1a152d9eaf5469740992b2dacdf62d patch
• https://www.vulncheck.com/advisories/wekan-card-comment-author-spoofing-via-user-controlled-authorid advisory pihak ketiga
• https://wekan.fi/ product