High severity · published Feb 7, 2026
CVE-2026-25561
WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as boardId, cardId, swimlaneId, and listId) are consistent and refer to a coherent card/board relationship, enabling attempts to upload attachments with mismatched object relationships.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
WeKan · WeKan
before 8.19 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25561
Patch
https://github.com/wekan/wekan/commit/1d16955b6d4f0a0282e89c2c1b0415c7597019b8
Product
https://wekan.fi/
Third Party Advisory
https://www.vulncheck.com/advisories/wekan-attachment-upload-object-relationship-validation-bypass
More from WeKan
9.9
CVE-2026-52891
Wekan: Shell Injection via Avatar Upload
9.8
CVE-2026-55652
Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)
9.8
CVE-2026-25560
WeKan < 8.19 LDAP Authentication Filter Injection
9.2
CVE-2026-52893
Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
8.8
CVE-2026-68561
Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule