CVE-2025-65780

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.

Score

CVSS 3.1 8.8 High

Status

Analyzed - cve@mitre.org

Published

2025-12-15

Last modified

2026-10-14

Weaknesses

CWE-284

Affected products

• Wekan (Wekan Project)

References

• https://github.com/wekan/wekan
• https://wekan.fi/hall-of-fame/spacebleed/
• https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release
• https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81