CVE-2026-25567CWE-639

WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId

Medium · published February 7, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-02-07T21:58Z
EPSS history
Timeline
  • 07 FEB 21:58Z
    WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId
    cvelistv5