VYPR
← All advisories
High severity8.8OSV Advisory· Published Dec 15, 2025· Updated Jun 17, 2026

CVE-2025-65780

CVE-2025-65780

Description

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Wekan/WekanOSV2 versions
    4.30, 4.31, stable, …+ 1 more
    • (no CPE)range: 4.30, 4.31, stable, …
    • (no CPE)range: <=18.15
  • Wekan Project/Wekan
    cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*
    Range: <8.16

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.