CVE-2026-25567

5.3 mediumEPSS 0.3%

Medium (5.3) in wekan project wekan. EPSS 0.3% chance of exploitation in the next 30 days.

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-02-07
Modified: 2026-07-14
Record from: the NVD, synced 2026-10-19

Affected

wekan_project:wekan

References

https://github.com/wekan/wekan/commit/67cb47173c1a152d9eaf5469740992b2dacdf62d
https://wekan.fi/
https://www.vulncheck.com/advisories/wekan-card-comment-author-spoofing-via-user-controlled-authorid

Check your stack JSON