VulnerabilityAnalyzed

CVE-2026-25567

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API.

MEDIUM 5.3EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.

CVSS 4.0: 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.26% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-639
Affected: wekan project/wekan
Source: disclosure@vulncheck.com

References

https://github.com/wekan/wekan/commit/67cb47173c1a152d9eaf5469740992b2dacdf62dPatch
https://wekan.fi/Product
https://www.vulncheck.com/advisories/wekan-card-comment-author-spoofing-via-user-controlled-authoridThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.