wekan vulnerabilities
CVEs whose affected-version data names the wekan package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2025-65782Medium· 6.5An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary…
CVE-2025-65781High· 8.2An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any n…
CVE-2025-65780High· 8.8An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to m…
CVE-2025-65779High· 7.5An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow returns true without verifying userId), allowing arbitrar…
CVE-2025-65778High· 8.1An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/…