CVE-2026-25563: Wekan Auth Bypass Vulnerability

CVE-2026-25563 Overview

CVE-2026-25563 is an Insecure Direct Object Reference (IDOR) vulnerability in WeKan, the open-source kanban board application. Versions prior to 8.19 fail to verify that a supplied cardId belongs to the supplied boardId in checklist creation and related checklist routes. An authenticated attacker can manipulate identifiers in API requests to create or modify checklists on cards belonging to boards they do not have access to. The flaw is categorized under CWE-639: Authorization Bypass Through User-Controlled Key. Exploitation requires only low privileges and network access, with no user interaction.

Critical Impact
Authenticated users can tamper with checklist data across board boundaries, compromising integrity of project data they should not be able to modify.

Affected Products

WeKan versions prior to 8.19
Self-hosted WeKan deployments using vulnerable checklist routes
WeKan Snap, Docker, and source installations on the affected branch

Discovery Timeline

2026-02-07 - CVE-2026-25563 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25563

Vulnerability Analysis

WeKan exposes server-side routes for creating and managing checklists attached to cards. Each card belongs to a single board, and authorization checks are intended to validate that the requesting user has access to that board. The vulnerable implementation accepts both a cardId and a boardId from the client without confirming the two are related. An attacker authenticated as a user on board A can issue a request specifying their own board's boardId together with a cardId from board B. The server performs permission checks against board A while operating on the card in board B.

This pattern matches the classic IDOR profile described in CWE-639. The vulnerability impacts integrity only — attackers can write checklist items to cards they should not control, but no confidentiality or availability impact is in scope. Full technical details are documented in the VulnCheck Advisory on WeKan.

Root Cause

The root cause is missing cross-reference validation between cardId and boardId parameters. The route handler trusts the client-supplied boardId for authorization while performing the mutation against the client-supplied cardId. The two identifiers are never reconciled against the database before the action is performed.

Attack Vector

An attacker needs a valid WeKan account and knowledge or guessing capability for a target cardId. Card identifiers may be obtained from shared links, screenshots, exported boards, or enumeration. The attacker crafts an HTTP request to a checklist creation or modification endpoint, supplying a boardId they legitimately access and a cardId from a private board. The server processes the write against the targeted card, achieving cross-board tampering.

No verified public exploit code is available. Refer to the upstream commit for the corrected authorization logic.

Detection Methods for CVE-2026-25563

Indicators of Compromise

Checklist creation or modification entries in WeKan logs where the acting user lacks membership on the affected board
HTTP requests to checklist routes containing mismatched cardId and boardId pairs
Unexpected checklist items appearing on cards with no corresponding activity from board members

Detection Strategies

Audit MongoDB checklists and activities collections for entries authored by users who are not members of the parent board
Instrument the WeKan API gateway or reverse proxy to log boardId and cardId parameters from checklist endpoints for offline correlation
Compare authoring userId on checklist changes against the board's members array to flag cross-board writes

Monitoring Recommendations

Enable verbose application logging on WeKan checklist routes and forward logs to a centralized SIEM
Alert on bursts of checklist creation requests originating from a single low-privileged account
Track HTTP 200 responses on checklist endpoints where the requester has no documented membership on the referenced card's board

How to Mitigate CVE-2026-25563

Immediate Actions Required

Upgrade WeKan to version 8.19 or later, which includes the fix from commit 5cd8758
Inventory all self-hosted WeKan instances and confirm version state before treating them as remediated
Review checklist and activity history on sensitive boards for unauthorized modifications since deployment

Patch Information

The upstream fix is committed in wekan/wekan@5cd8758. The patch adds validation that the supplied cardId belongs to the supplied boardId before permitting checklist operations. Administrators running container images should pull the updated wekanteam/wekan image tag aligned with version 8.19 or newer. Source-based deployments should rebuild from the patched branch.

Workarounds

Restrict WeKan access to trusted users via network ACLs or VPN until the patch is applied
Disable or remove low-trust user accounts on shared WeKan instances pending upgrade
Place WeKan behind a reverse proxy that logs and rate-limits checklist endpoints to deter enumeration

bash

# Upgrade WeKan via Docker to a patched release
docker pull wekanteam/wekan:v8.19
docker stop wekan-app && docker rm wekan-app
docker run -d --name wekan-app \
  --env-file /opt/wekan/wekan.env \
  -p 3001:8080 \
  wekanteam/wekan:v8.19