# CVE-2026-25566: WeKan incorrect authorization in cross-board card move logic

Source: https://junglewise.ai/threats/cve-2026-25566-wekan-incorrect-authorization-in-cross-board-card-move-logic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-07. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-25566 · Severity: medium · CVSS 5.4 · Published 2026-02-07

WeKan, an open-source project management tool, contains a security flaw in how it handles moving tasks between different project boards. An authorized user could move tasks into boards or lists they do not have permission to access by bypassing authorization checks. This could lead to unauthorized data modification or organizational disruption by placing information in restricted areas.

Technologies: [WeKan](https://junglewise.ai/threats/technologies/wekan). Vendors: [WeKan](https://junglewise.ai/threats/vendors/wekan).

## Quick answers

**Is CVE-2026-25566 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25566 being exploited in the wild.

**How severe is CVE-2026-25566?** Medium severity, with a CVSS score of 5.4, published 7 February 2026.

**Which products and versions are affected?** WeKan prior to 8.19.

**Is there a fix for CVE-2026-25566?** A patch was published on 2026-02-07: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25566 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-25566?** Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) exists in the card movement logic of WeKan versions prior to 8.19. The application failed to perform adequate authorization checks on the destination board and did not validate that destination objects (lists or swimlanes) actually belonged to the specified destination board. A remote authenticated attacker can exploit this by specifying a destination board/list/swimlane they are not authorized to access, enabling unauthorized cross-board moves. The issue was addressed in version 8.19 by adding 'Authentication.checkBoardAccess' and validating the existence and ownership of destination lists.

## Affected products

- WeKan WeKan prior to 8.19

## Timeline

- 2026-02-07: advisory: Initial advisory published by VulnCheck
- 2026-02-07: patched: Fix committed to GitHub repository

## References

- [https://github.com/wekan/wekan/commit/198509e7600981400353aec6259247b3c04e043e](https://github.com/wekan/wekan/commit/198509e7600981400353aec6259247b3c04e043e)
- [https://wekan.fi/](https://wekan.fi/)
- [https://www.vulncheck.com/advisories/wekan-cross-board-card-move-without-destination-authorization](https://www.vulncheck.com/advisories/wekan-cross-board-card-move-without-destination-authorization)

## Related threats

- [Wekan ReDoS in user search via unescaped regex](https://junglewise.ai/threats/cve-2026-119300-wekan-is-open-source-kanban-built-with-meteor-prior-to-11-11-the)
- [Wekan authentication bypass via X-Forwarded-For spoofing in header-login](https://junglewise.ai/threats/cve-2026-55652-wekan-authentication-bypass-via-x-forwarded-for-spoofing-in)
- [Wekan broken access control in DDP update rules](https://junglewise.ai/threats/cve-2026-55234-wekan-broken-access-control-in-ddp-update-rules)
- [Wekan missing authorization in cloneBoard method](https://junglewise.ai/threats/cve-2026-53447-wekan-missing-authorization-in-cloneboard-method)
- [Wekan SSRF in webhook integration URLs](https://junglewise.ai/threats/cve-2026-53446-wekan-ssrf-in-webhook-integration-urls)