CVE-2026-25567: WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-07 · updated 2026-07-14
Weakness: CWE-639

Description

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.

Affected products

WeKan: before 8.19 — fixed in 8.19

How to fix

Upgrade to a fixed version: WeKan 8.19. Check the vendor advisory for mitigations.

References

https://github.com/wekan/wekan/commit/67cb47173c1a152d9eaf5469740992b2dacdf62d
https://wekan.fi/
https://www.vulncheck.com/advisories/wekan-card-comment-author-spoofing-via-user-controlled-authorid

Get alerted when CVE-2026-25567 or the next vulnerability affects your stack