CVE-2025-65781

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/wekan/wekan	Product
https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release	Release Notes
https://github.com/wekan/wekan/commit/ccd90343394f433b287733ad0a33c08e0a71f53c	Patch
https://wekan.fi/hall-of-fame/spacebleed/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en Wekan, el sistema de tablero kanban de código abierto, hasta la versión 18.15, corregido en la 18.16. La API de carga de archivos adjuntos trata el valor del portador de autorización como un userId y entra en una rama de manejo de cuerpo no terminante para cualquier token de portador no vacío, lo que permite un DoS trivial a nivel de aplicación y suplantación de identidad latente.

Information

Published : 2025-12-15 14:15

Updated : 2026-10-14 13:10

NVD link : CVE-2025-65781

Mitre link : CVE-2025-65781

CVE.ORG link : CVE-2025-65781

JSON object : View

Products Affected

wekan_project

wekan

CWE

CWE-287

Improper Authentication

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2025-65781", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65781", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T15:53:06.884126Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-15T14:15:57.567", "references": [{"url": "https://github.com/wekan/wekan", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/wekan/wekan/commit/ccd90343394f433b287733ad0a33c08e0a71f53c", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://wekan.fi/hall-of-fame/spacebleed/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Wekan, el sistema de tablero kanban de c\u00f3digo abierto, hasta la versi\u00f3n 18.15, corregido en la 18.16. La API de carga de archivos adjuntos trata el valor del portador de autorizaci\u00f3n como un userId y entra en una rama de manejo de cuerpo no terminante para cualquier token de portador no vac\u00edo, lo que permite un DoS trivial a nivel de aplicaci\u00f3n y suplantaci\u00f3n de identidad latente."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F031B735-9703-4B9D-BDE9-CC4226B5EBD0", "versionEndExcluding": "8.16"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}