VulnerabilityAnalyzed

CVE-2025-65782

Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.

MEDIUM 6.5EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.26% probability · 18th percentile
CISA KEV: Not listed
Weakness: CWE-285
Affected: wekan project/wekan
Source: cve@mitre.org

References

https://github.com/wekan/wekanProduct
https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--releaseRelease Notes
https://github.com/wekan/wekan/commit/0a1a075f3153e71d9a858576f1c68d2925230d9cPatch
https://wekan.fi/hall-of-fame/spacebleed/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.