CVE-2025-65780High· 8.8▾ TwilightAn issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to m…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.
wekan < 8.16Upgrade past the affected range:
wekan 8.16Connected by shared product, vendor, weakness, or advisory.
CVE-2025-65779High· 7.5An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
CVE-2025-65782Medium· 6.5An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
CVE-2025-65781High· 8.2An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
CVE-2025-65778High· 8.1An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
CVE-2025-0040NoneImproper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or overwrite the contents of cross-chip debug (XCD) registers potentially res…
CVE-2025-43524High· 8.8An access issue was addressed with additional sandbox restrictions