Is CVE-2026-25859 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25859 being exploited in the wild.

How severe is CVE-2026-25859?

High severity, with a CVSS score of 8.8, published 7 February 2026.

Is there a fix for CVE-2026-25859?

A patch was published on 2026-02-07: Fix commit cbb1cd7 identified in version 8.20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25859 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-25859?

Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25859: WeKan incorrect authorization in migration functionality

CVE-2026-25859 · Severity: high · CVSS 8.8 · Published 2026-02-07

WeKan, an open-source Kanban board application used for project management, contains a security flaw where standard users can access administrative migration tools. An attacker with a basic user account could trigger unauthorized data migration operations, potentially leading to data loss, service disruption, or unauthorized modification of project boards. This undermines the platform's access controls and could impact business operations and data integrity.

Technologies: WeKan. Vendors: WeKan.

Quick answers

Is CVE-2026-25859 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25859 being exploited in the wild.
How severe is CVE-2026-25859?: High severity, with a CVSS score of 8.8, published 7 February 2026.
Which products and versions are affected?: WeKan < 8.20.
Is there a fix for CVE-2026-25859?: A patch was published on 2026-02-07: Fix commit cbb1cd7 identified in version 8.20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25859 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-25859?: Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in WeKan versions prior to 8.20. The application fails to perform sufficient permission checks on its migration functionality, allowing authenticated users without administrative privileges to access and execute migration tasks. An attacker with low-privileged network access can exploit this to perform unauthorized migration operations, which may impact the integrity and availability of the system's data. The issue was addressed in version 8.20 by moving migration controls to the Admin Panel and implementing proper access checks.

Affected products

WeKan WeKan < 8.20

Timeline

2026-02-07: disclosed: Initial disclosure by VulnCheck
2026-02-07: advisory: NVD publication date
2026-02-07: patched: Fix commit cbb1cd7 identified in version 8.20

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.