What’s Vulnerable › Vulnerabilities

CVE-2025-65780

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-15 · updated 2026-10-14
• Weakness: CWE-284

Description

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.

Affected products

• WeKan: before 8.16 — fixed in 8.16

How to fix

Upgrade to a fixed version: WeKan 8.16. Check the vendor advisory for mitigations.

References

• https://github.com/wekan/wekan
• https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release
• https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81
• https://wekan.fi/hall-of-fame/spacebleed/

Get alerted when CVE-2025-65780 or the next vulnerability affects your stack