An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.
References
| Link | Resource |
|---|---|
| https://github.com/wekan/wekan | Product |
| https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release | Release Notes |
| https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81 | Patch |
| https://wekan.fi/hall-of-fame/spacebleed/ | Vendor Advisory |
Configurations
History
18 Dec 2025, 01:37
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wekan Project wekan
Wekan Project |
|
| CPE | cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* | |
| References | () https://github.com/wekan/wekan - Product | |
| References | () https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release - Release Notes | |
| References | () https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81 - Patch | |
| References | () https://wekan.fi/hall-of-fame/spacebleed/ - Vendor Advisory |
17 Dec 2025, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-284 |
15 Dec 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-15 14:15
Updated : 2025-12-18 01:37
NVD link : CVE-2025-65780
Mitre link : CVE-2025-65780
CVE.ORG link : CVE-2025-65780
JSON object : View
Products Affected
wekan_project
- wekan
CWE
CWE-284
Improper Access Control