CVE-2026-25562

5.3 mediumEPSS 0.3%

Medium (5.3) in wekan project wekan. EPSS 0.3% chance of exploitation in the next 30 days.

WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without properly scoping results to boards and cards accessible to the requesting user, potentially exposing attachment metadata to unauthorized users.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-203
Published: 2026-02-07
Modified: 2026-07-14
Record from: the NVD, synced 2026-10-19

Affected

wekan_project:wekan

References

https://github.com/wekan/wekan/commit/6dfa3beb2b6ab23438d0f4395b84bf0749eb4820
https://wekan.fi/
https://www.vulncheck.com/advisories/wekan-attachments-publication-information-disclosure

Check your stack JSON