CVE-2025-65782

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/wekan/wekan	Product
https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release	Release Notes
https://github.com/wekan/wekan/commit/0a1a075f3153e71d9a858576f1c68d2925230d9c	Patch
https://wekan.fi/hall-of-fame/spacebleed/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en Wekan, el sistema de tablero kanban de código abierto, hasta la versión 18.15, corregido en la 18.16. Un fallo de autorización en el manejo de la actualización de tarjetas permite a los miembros del tablero (y potencialmente a otros usuarios autenticados) añadir/eliminar IDs de usuario arbitrarios en los arrays vote.positive / vote.negative, lo que permite la falsificación de votos y la votación no autorizada.

Information

Published : 2025-12-15 14:15

Updated : 2026-10-14 13:10

NVD link : CVE-2025-65782

Mitre link : CVE-2025-65782

CVE.ORG link : CVE-2025-65782

JSON object : View

Products Affected

wekan_project

wekan

CWE

NVD-CWE-noinfo CWE-285

Improper Authorization

{"id": "CVE-2025-65782", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65782", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T15:37:10.755365Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-15T14:15:57.680", "references": [{"url": "https://github.com/wekan/wekan", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/wekan/wekan/commit/0a1a075f3153e71d9a858576f1c68d2925230d9c", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://wekan.fi/hall-of-fame/spacebleed/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Wekan, el sistema de tablero kanban de c\u00f3digo abierto, hasta la versi\u00f3n 18.15, corregido en la 18.16. Un fallo de autorizaci\u00f3n en el manejo de la actualizaci\u00f3n de tarjetas permite a los miembros del tablero (y potencialmente a otros usuarios autenticados) a\u00f1adir/eliminar IDs de usuario arbitrarios en los arrays vote.positive / vote.negative, lo que permite la falsificaci\u00f3n de votos y la votaci\u00f3n no autorizada."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D13533B-E5D9-47D8-97E7-6FEC5357E4E6", "versionEndIncluding": "8.15"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}