# CVE-2026-25562: WeKan information disclosure in attachments publication

Source: https://junglewise.ai/threats/cve-2026-25562-wekan-information-disclosure-in-attachments-publication  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-07. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-25562 · Severity: medium · CVSS 4.3 · Published 2026-02-07

WeKan, an open-source Kanban board used for project management and task tracking, contains a security flaw in how it handles file attachments. An authenticated user could potentially view metadata for files attached to boards or cards they are not authorized to access. This could lead to the exposure of sensitive project details, file names, or organizational structures to unauthorized personnel.

Technologies: [WeKan](https://junglewise.ai/threats/technologies/wekan). Vendors: [WeKan](https://junglewise.ai/threats/vendors/wekan).

## Quick answers

**Is CVE-2026-25562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25562 being exploited in the wild.

**How severe is CVE-2026-25562?** Medium severity, with a CVSS score of 4.3, published 7 February 2026.

**Which products and versions are affected?** WeKan < 8.19.

**Is there a fix for CVE-2026-25562?** A patch was published on 2026-02-07: Fix committed in GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25562 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-25562?** Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in WeKan's 'attachmentsList' publication due to improper authorization checks (CWE-203/CWE-285). The server-side publication failed to validate if the requesting user had sufficient permissions to view the boards or cards associated with specific attachment metadata. A remote, authenticated attacker can exploit this by querying the attachments publication to retrieve metadata for files they should not be able to see. The vulnerability is addressed in version 8.19 by implementing a check that scopes results to boards where the user is either a member or the board is set to public.

## Affected products

- WeKan WeKan < 8.19

## Timeline

- 2026-02-07: advisory: Initial disclosure by VulnCheck
- 2026-02-07: patched: Fix committed in GitHub repository

## References

- [https://github.com/wekan/wekan/commit/6dfa3beb2b6ab23438d0f4395b84bf0749eb4820](https://github.com/wekan/wekan/commit/6dfa3beb2b6ab23438d0f4395b84bf0749eb4820)
- [https://wekan.fi/](https://wekan.fi/)
- [https://www.vulncheck.com/advisories/wekan-attachments-publication-information-disclosure](https://www.vulncheck.com/advisories/wekan-attachments-publication-information-disclosure)

## Related threats

- [Wekan ReDoS in user search via unescaped regex](https://junglewise.ai/threats/cve-2026-119300-wekan-is-open-source-kanban-built-with-meteor-prior-to-11-11-the)
- [Wekan authentication bypass via X-Forwarded-For spoofing in header-login](https://junglewise.ai/threats/cve-2026-55652-wekan-authentication-bypass-via-x-forwarded-for-spoofing-in)
- [Wekan broken access control in DDP update rules](https://junglewise.ai/threats/cve-2026-55234-wekan-broken-access-control-in-ddp-update-rules)
- [Wekan missing authorization in cloneBoard method](https://junglewise.ai/threats/cve-2026-53447-wekan-missing-authorization-in-cloneboard-method)
- [Wekan SSRF in webhook integration URLs](https://junglewise.ai/threats/cve-2026-53446-wekan-ssrf-in-webhook-integration-urls)