CVE-2026-25562CWE-203

WeKan < 8.19 Attachments Publication Information Disclosure

Medium · published February 7, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without properly scoping results to boards and cards accessible to the requesting user, potentially exposing attachment metadata to unauthorized users.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00424 · 35.6th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2026-02-07T21:57Z
EPSS history
Timeline
  • 07 FEB 21:57Z
    WeKan < 8.19 Attachments Publication Information Disclosure
    cvelistv5