CVE-2026-25568: Wekan Auth Bypass Vulnerability

CVE-2026-25568 Overview

CVE-2026-25568 is an authorization bypass vulnerability affecting WeKan, an open-source kanban board application. Versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled by administrators to restrict all boards to private visibility, users can still create public boards due to incomplete server-side enforcement.

This vulnerability represents a significant security gap for organizations relying on WeKan's privacy controls to protect sensitive project data and workflows from unauthorized external access.

Critical Impact
Organizations using WeKan with allowPrivateOnly enabled may have unintentionally exposed project boards publicly, potentially leaking sensitive business data, project plans, and internal communications.

Affected Products

WeKan versions prior to 8.19
Self-hosted WeKan deployments with allowPrivateOnly setting enabled
Cloud-hosted WeKan instances using private-only board configurations

Discovery Timeline

2026-02-07 - CVE-2026-25568 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-25568

Vulnerability Analysis

This vulnerability falls under CWE-863 (Incorrect Authorization), a class of flaws where software performs an authorization check improperly, allowing actors to access resources or perform actions outside their intended permissions.

The core issue stems from insufficient server-side validation when processing board creation requests. While the WeKan application provides an administrative setting (allowPrivateOnly) intended to enforce private visibility for all boards at the instance level, the enforcement mechanism was incomplete. The client-side or API-level checks could be bypassed, allowing authenticated users to create boards with public visibility despite the administrative restriction.

This authorization bypass could expose sensitive organizational data to unauthorized users or the public internet, depending on the deployment configuration.

Root Cause

The root cause is improper enforcement of the allowPrivateOnly configuration setting during the board creation workflow. The visibility mode settings were not being properly validated against the instance-level configuration in the models/boards.js file. The fix introduces a proper import and check of TableVisibilityModeSettings to ensure server-side enforcement of the private-only restriction.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user. An attacker with a valid WeKan account can craft a board creation request specifying public visibility, bypassing the intended allowPrivateOnly restriction. This requires no user interaction and can be performed with low attack complexity.

The attack scenario involves:

Administrator enables allowPrivateOnly setting to restrict all boards to private
Authenticated user creates a new board via the web interface or API
User specifies or manipulates the visibility parameter to "public"
Server fails to enforce the allowPrivateOnly restriction
Public board is created, potentially exposing sensitive data

javascript

   TYPE_TEMPLATE_CONTAINER,
 } from '/config/const';
 import Users from "./users";
+import TableVisibilityModeSettings from "./tableVisibilityModeSettings";

 // const escapeForRegex = require('escape-string-regexp');

Source: GitHub Commit

The patch introduces the TableVisibilityModeSettings import to properly validate board visibility against instance-level configuration settings during board creation.

Detection Methods for CVE-2026-25568

Indicators of Compromise

Public boards existing in WeKan instances where allowPrivateOnly should be enforced
Board creation events with public visibility setting in application logs when private-only mode is enabled
Unexpected external access patterns to board content from unauthenticated sources

Detection Strategies

Audit existing boards for visibility settings that violate the intended allowPrivateOnly policy
Review WeKan application logs for board creation events and validate visibility parameters
Implement monitoring for board visibility changes and creation events at the database level
Use network traffic analysis to identify external access to board resources that should be private

Monitoring Recommendations

Enable comprehensive logging for board creation and modification events in WeKan
Set up alerts for any board with public visibility when allowPrivateOnly is configured
Monitor access logs for unauthenticated requests to board endpoints
Periodically audit board visibility settings against organizational security policies

How to Mitigate CVE-2026-25568

Immediate Actions Required

Upgrade WeKan to version 8.19 or later immediately
Audit all existing boards to identify any that were created with public visibility when they should be private
Change visibility of any improperly exposed boards to private
Review access logs to determine if sensitive data may have been accessed by unauthorized parties

Patch Information

The vulnerability has been addressed in WeKan version 8.19. The fix properly enforces the allowPrivateOnly setting at the server level during board creation by importing and validating against TableVisibilityModeSettings. Organizations should update to the patched version as soon as possible.

For detailed patch information, refer to the GitHub commit and the VulnCheck Security Advisory.

Workarounds

Temporarily disable public board creation at the network/proxy level if possible
Implement additional access controls at the reverse proxy or firewall level to restrict board access
Manually audit and convert any public boards to private until the patch can be applied
Consider temporarily restricting board creation permissions to trusted administrators only

bash

# Configuration example - Audit existing public boards in MongoDB
mongo wekan --eval "db.boards.find({permission: 'public'}).forEach(function(b) { print(b.title + ': ' + b._id); })"

# Convert public boards to private (after backup)
# mongo wekan --eval "db.boards.updateMany({permission: 'public'}, {\$set: {permission: 'private'}})"