Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Wekan — Vulnerabilities & Security Advisories 51

All 51 CVE vulnerabilities found in Wekan, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security advisories and vulnerability data specifically for the Wekan open-source Kanban board application, categorized under web application weaknesses and software supply chain risks. The collection encompasses a comprehensive range of reported issues, including cross-site scripting flaws, authentication bypasses, and server-side request injection vulnerabilities, covering the product's entire public disclosure history from its initial release to the current stable version. Visitors can utilize this resource to track the vendor's official security advisories, analyze the prevalence of specific weakness classes within collaborative project management tools, or review the complete vulnerability history of the Wekan platform to assess long-term security trends. By centralizing these findings, the page serves as a factual reference for security professionals, system administrators, and developers seeking to understand the historical security posture of this specific software without navigating disparate sources. The data presented focuses strictly on technical details and remediation status, enabling users to make informed decisions regarding patching strategies and risk mitigation. This aggregation supports proactive security monitoring and helps organizations maintain compliance with software vulnerability management standards by providing a unified view of known threats associated with the Wekan ecosystem.

Vendor: Wekan Team

CVE ID Title CVSS Severity Published
CVE-2026-2205 WeKan Meteor Publication cards.js CardPubSubBleed information disclosure CWE-200 4.3 Medium 2026-02-08
CVE-2026-25859 WeKan < 8.20 Migration Functionality Insufficient Permission Checks CWE-863 7.1AI High AI 2026-02-07
CVE-2026-25568 WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass CWE-863 6.5AI Medium AI 2026-02-07
CVE-2026-25567 WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId CWE-639 6.5AI Medium AI 2026-02-07
CVE-2026-25566 WeKan < 8.19 Cross-board Card Move Without Destination Authorization CWE-863 3.3AI Low AI 2026-02-07
CVE-2026-25565 WeKan < 8.19 Read-only Board Roles Can Update Cards CWE-863 4.3AI Medium AI 2026-02-07
CVE-2026-25564 WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation CWE-639 6.5AI Medium AI 2026-02-07
CVE-2026-25563 WeKan < 8.19 Checklist Creation Cross-Board IDOR CWE-639 6.5AI Medium AI 2026-02-07
CVE-2026-25562 WeKan < 8.19 Attachments Publication Information Disclosure CWE-203 5.3AI Medium AI 2026-02-07
CVE-2026-25561 WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass CWE-863 7.5AI High AI 2026-02-07
CVE-2026-25560 WeKan < 8.19 LDAP Authentication Filter Injection CWE-90 7.5AI High AI 2026-02-07
CVE-2026-1964 WeKan REST Endpoint boards.js BoardTitleRESTBleed access control CWE-284 4.3 Medium 2026-02-05
CVE-2026-1963 WeKan Attachment Storage attachments.js MoveStorageBleed access control CWE-284 6.3 Medium 2026-02-05
CVE-2026-1962 WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control CWE-284 6.3 Medium 2026-02-05
CVE-2026-1898 WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control CWE-284 6.3 Medium 2026-02-05
CVE-2026-1897 WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization CWE-862 4.3 Medium 2026-02-05
CVE-2026-1896 WeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control CWE-284 6.3 Medium 2026-02-04
CVE-2026-1895 WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control CWE-284 6.3 Medium 2026-02-04
CVE-2026-1894 WeKan REST API checklistItems.js Checklist REST Bleed improper authorization CWE-285 6.3 Medium 2026-02-04
CVE-2026-1892 WeKan REST API boards.js setBoardOrgs improper authorization CWE-285 5.0 Medium 2026-02-04
CVE-2021-20654 Wekan 跨站脚本漏洞 CWE-79 6.1 - 2021-02-10

All 51 known CVE vulnerabilities affecting Wekan with full Chinese analysis, references, and POCs where available.