Is CVE-2026-25566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25566 being exploited in the wild.

How severe is CVE-2026-25566?

Medium severity, with a CVSS score of 5.4, published 7 February 2026.

Is there a fix for CVE-2026-25566?

A patch was published on 2026-02-07: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25566 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-25566?

Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25566: WeKan incorrect authorization in cross-board card move logic

CVE-2026-25566 · Severity: medium · CVSS 5.4 · Published 2026-02-07

WeKan, an open-source project management tool, contains a security flaw in how it handles moving tasks between different project boards. An authorized user could move tasks into boards or lists they do not have permission to access by bypassing authorization checks. This could lead to unauthorized data modification or organizational disruption by placing information in restricted areas.

Technologies: WeKan. Vendors: WeKan.

Quick answers

Is CVE-2026-25566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25566 being exploited in the wild.
How severe is CVE-2026-25566?: Medium severity, with a CVSS score of 5.4, published 7 February 2026.
Which products and versions are affected?: WeKan prior to 8.19.
Is there a fix for CVE-2026-25566?: A patch was published on 2026-02-07: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25566 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-25566?: Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in the card movement logic of WeKan versions prior to 8.19. The application failed to perform adequate authorization checks on the destination board and did not validate that destination objects (lists or swimlanes) actually belonged to the specified destination board. A remote authenticated attacker can exploit this by specifying a destination board/list/swimlane they are not authorized to access, enabling unauthorized cross-board moves. The issue was addressed in version 8.19 by adding 'Authentication.checkBoardAccess' and validating the existence and ownership of destination lists.

Affected products

WeKan WeKan prior to 8.19

Timeline

2026-02-07: advisory: Initial advisory published by VulnCheck
2026-02-07: patched: Fix committed to GitHub repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.