PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-25564 Wekan Project CVE debrief

CVE-2026-25564 is an insecure direct object reference (IDOR) vulnerability in Wekan versions prior to 8.19. The implementation does not verify that the supplied cardId belongs to the supplied boardId, allowing cross-board ID tampering by manipulating identifiers. This vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. Users of Wekan versions prior to 8.19 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 8.19 or later and verifying that the supplied cardId belongs to the supplied boardId in checklist creation and related checklist routes.

Vendor
Wekan Project
Product
Wekan
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-07
Original CVE updated
2026-07-14
Advisory published
2026-02-07
Advisory updated
2026-07-14

Who should care

Users of Wekan versions prior to 8.19, administrators, security teams, and operators of Wekan deployments should be aware of this vulnerability and take steps to mitigate it, including verifying checklist creation and related checklist routes, reviewing compensating controls, and monitoring for suspicious activity. Additionally, affected operators, platform administrators, vulnerability management teams, and security teams should prioritize and validate mitigations, ensuring accurate tracking and closure of remediated assets.

Technical summary

The vulnerability exists in the checklist creation and related checklist routes of Wekan versions prior to 8.19. An attacker can manipulate identifiers to perform cross-board ID tampering. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. This technical summary is based on the provided source corpus and CVE details.

Defensive priority

High

Recommended defensive actions

  • Upgrade to Wekan version 8.19 or later
  • Verify that the supplied cardId belongs to the supplied boardId in checklist creation and related checklist routes
  • Monitor for suspicious activity in checklist creation and related checklist routes
  • Implement additional security measures to prevent cross-board ID tampering
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-02-07T22:16:01.903Z and was last modified on 2026-07-14T16:16:54.673Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus. Further verification is recommended to ensure accuracy.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-02-07T22:16:01.903Z and has not been modified since then. The NVD entry is currently Analyzed.