Medium severity · published Dec 15, 2025
CVE-2025-65782
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Wekan · Wekan Project
through 8.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65782
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65782
Product
https://github.com/wekan/wekan
Release Notes
https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release
Patch
https://github.com/wekan/wekan/commit/0a1a075f3153e71d9a858576f1c68d2925230d9c
Vendor Advisory
https://wekan.fi/hall-of-fame/spacebleed/
More from Wekan
9.8
CVE-2026-25560
WeKan < 8.19 LDAP Authentication Filter Injection
9.8
CVE-2026-1963
WeKan Attachment Storage attachments.js MoveStorageBleed access control
9.8
CVE-2026-1962
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
8.8
CVE-2026-2206
WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
8.8
CVE-2026-25859
WeKan < 8.20 Migration Functionality Insufficient Permission Checks