High severity · published Dec 15, 2025
CVE-2025-65780
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
8.8
CVSS
0.3%
EPSS
No
On KEV
Description
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Wekan · Wekan Project
before 8.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65780
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65780
Product
https://github.com/wekan/wekan
Release Notes
https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release
Patch
https://github.com/wekan/wekan/commit/f26d58201855e861bab1cd1fda4d62c664efdb81
Vendor Advisory
https://wekan.fi/hall-of-fame/spacebleed/
More from Wekan
9.8
CVE-2026-25560
WeKan < 8.19 LDAP Authentication Filter Injection
9.8
CVE-2026-1963
WeKan Attachment Storage attachments.js MoveStorageBleed access control
9.8
CVE-2026-1962
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
8.8
CVE-2026-2206
WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
8.8
CVE-2026-25859
WeKan < 8.20 Migration Functionality Insufficient Permission Checks