Is CVE-2026-25568 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25568 being exploited in the wild.

How severe is CVE-2026-25568?

Medium severity, with a CVSS score of 4.3, published 7 February 2026.

Is there a fix for CVE-2026-25568?

A patch was published on 2026-02-07: Fixed in version 8.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25568 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-25568?

Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25568: WeKan authorization bypass in allowPrivateOnly setting

CVE-2026-25568 · Severity: medium · CVSS 4.3 · Published 2026-02-07

WeKan is an open-source Kanban board application used for project management and task tracking. A security flaw in versions prior to 8.19 allows users to create public boards even when administrators have configured the system to only allow private boards. This could lead to sensitive project information being unintentionally exposed to the public or unauthorized users, potentially compromising corporate data and operational privacy.

Technologies: WeKan. Vendors: WeKan.

Quick answers

Is CVE-2026-25568 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25568 being exploited in the wild.
How severe is CVE-2026-25568?: Medium severity, with a CVSS score of 4.3, published 7 February 2026.
Which products and versions are affected?: WeKan < 8.19.
Is there a fix for CVE-2026-25568?: A patch was published on 2026-02-07: Fixed in version 8.19 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25568 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-25568?: Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in WeKan's board creation logic. The 'allowPrivateOnly' configuration setting, intended to restrict board visibility to private-only across an instance, is not properly validated on the server side during the board creation process. A remote, authenticated user can bypass this restriction to create boards with public visibility. This issue stems from incomplete enforcement in the server-side models, specifically within 'models/boards.js'. The vulnerability is addressed in version 8.19 by implementing stricter server-side checks on visibility mode settings.

Affected products

WeKan WeKan < 8.19

Timeline

2026-02-07: disclosed
2026-02-07: patched: Fixed in version 8.19
2026-02-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.