CVE-2026-25859 Wekan Project CVE debrief

Who should care

Administrators and users of Wekan versions prior to 8.20 should be aware of this vulnerability and take necessary actions to mitigate it. This includes updating to version 8.20 or later and reviewing access to migration functionality. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize mitigation efforts.

Technical summary

The vulnerability exists in the migration functionality of Wekan, allowing non-administrative users to access and potentially perform unauthorized migration operations. This is due to insufficient permission checks in the affected versions. The issue affects Wekan versions prior to 8.20. The CVE record and NVD entry provide limited details about the vulnerability's impact and affected configurations.

Defensive priority

High

Recommended defensive actions

• Update Wekan to version 8.20 or later
• Review and restrict access to migration functionality
• Monitor for suspicious activity related to migration operations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-02-07T22:16:02.910Z and last modified on 2026-07-14T16:16:55.650Z. The NVD entry is currently Analyzed. Evidence from the CVE record and NVD entry indicates that Wekan versions prior to 8.20 are affected. However, specific details about the vulnerability's impact and affected configurations are limited. Defenders should verify the official CVE record and NVD entry for the most up-to-date information.

Official resources