Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-25568: WeKan: Public boards can be created with private boards setting enabled
CVE-2026-25568 · published 9 months ago
Summary
Prior to WeKan version 8.19, some users can create public boards even when the instance is set to only allow private boards. This can lead to unauthorized access to sensitive information. Update WeKan to version 8.19 or later to ensure proper board creation is enforced.
What to do
- Update wekan_project wekan to version 8.19 or later.
- Update wekan wekan to version 8.19 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wekan_project | wekan |
< 8.19 cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* |
| wekan | wekan | < 8.19 |
Original advisory text
WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass
WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement.
References
- https://wekan.fi/ URL
- https://www.vulncheck.com/advisories/wekan-allowprivateonly-setting-enforcement-... Vendor Advisory
- https://github.com/wekan/wekan/commit/7ed76c180ede46ab1dac6b8ad27e9128a272c2c8 Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25568... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25568 Vendor Advisory
- https://github.com/wekan/wekan Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-863Incorrect Authorization
Timeline
Published7 Feb 2026
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta