CVE-2025-65780 - An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16

Back Back to CVE browser

HIGH

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16

Published Dec 15, 2025

8.8

HIGH

CVSS 3.1

EPSS 0.34%

Description

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203373
Advisory
https://github.com/wekan/wekan
Product
https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release
Release Notes
https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81
Patch
https://wekan.fi/hall-of-fame/spacebleed/
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203373		Advisory
https://github.com/wekan/wekan		Product
https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release		Release Notes
https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81		Patch
https://wekan.fi/hall-of-fame/spacebleed/		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 15, 2025

Updated Dec 17, 2025

Reserved Nov 18, 2025

Link CVE-2025-65780

CISA Vulnrichment

Updated Dec 16, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-65780

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Dec 15, 2025

Updated Dec 17, 2025

Link EUVD-2025-203373

GitHub

No data