Unrated severityNVD Advisory· Published Feb 7, 2026· Updated Mar 5, 2026
WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId
CVE-2026-25567
Description
WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/wekan/wekan/commit/67cb47173c1a152d9eaf5469740992b2dacdf62dmitrepatch
- www.vulncheck.com/advisories/wekan-card-comment-author-spoofing-via-user-controlled-authoridmitrethird-party-advisory
- wekan.fimitreproduct
News mentions
0No linked articles in our index yet.