wekan vulnerabilities and fixes

Recent CVEs affecting wekan, with upgrade or downgrade steps. 34 tracked.

wekan has 34 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 32. Most recent: 2026-03-06. Highest priority: CVE-2026-25560 (score 53/100).

• CVE-2025-65781 HIGH 8.2 UPGRADE An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
• CVE-2025-65780 HIGH 8.8 UPGRADE An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
• CVE-2025-65779 HIGH 7.5 UPGRADE An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
• CVE-2025-65778 HIGH 8.1 UPGRADE An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
• CVE-2025-65782 MEDIUM 6.5 UPGRADE An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16
• CVE-2026-25859 HIGH 8.8 UPGRADE Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insuffici
• CVE-2026-25568 MEDIUM 4.3 UPGRADE WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration set
• CVE-2026-25567 MEDIUM 4.3 UPGRADE WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation A
• CVE-2026-25566 MEDIUM 5.4 UPGRADE WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic
• CVE-2026-25565 MEDIUM 6.5 UPGRADE WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths valida
• CVE-2026-25564 HIGH 7.5 UPGRADE WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and rela
• CVE-2026-25563 HIGH 7.5 UPGRADE WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and rela
• CVE-2026-25562 MEDIUM 4.3 UPGRADE WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication
• CVE-2026-25561 HIGH 7.5 UPGRADE WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API
• CVE-2026-25560 CRITICAL 9.8 UPGRADE WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication
• CVE-2026-30847 MEDIUM 6.5 UPGRADE Wekan is an open source kanban tool built with Meteor
• CVE-2026-30846 HIGH 7.5 UPGRADE Wekan is an open source kanban tool built with Meteor
• CVE-2026-30845 HIGH 8.2 UPGRADE Wekan is an open source kanban tool built with Meteor
• CVE-2026-30844 HIGH 8.1 DOWNGRADE Wekan is an open source kanban tool built with Meteor
• CVE-2026-30843 MEDIUM 6.5 DOWNGRADE Wekan is an open source kanban tool built with Meteor
• CVE-2026-2209 MEDIUM 6.3 UPGRADE A vulnerability was detected in WeKan up to 8.18
• CVE-2026-2208 MEDIUM 4.3 UPGRADE A security vulnerability has been detected in WeKan up to 8.20
• CVE-2026-2207 MEDIUM 5.3 UPGRADE A weakness has been identified in WeKan up to 8.20
• CVE-2026-2206 MEDIUM 6.3 UPGRADE A security flaw has been discovered in WeKan up to 8.20
• CVE-2026-2205 MEDIUM 4.3 UPGRADE A vulnerability was identified in WeKan up to 8.20
• CVE-2026-1964 MEDIUM 4.3 UPGRADE A vulnerability was determined in WeKan up to 8.20
• CVE-2026-1963 MEDIUM 6.3 UPGRADE A vulnerability was found in WeKan up to 8.20
• CVE-2026-1962 MEDIUM 6.3 UPGRADE A vulnerability has been found in WeKan up to 8.20
• CVE-2026-1898 MEDIUM 6.3 UPGRADE A vulnerability was determined in WeKan up to 8.20
• CVE-2026-1897 MEDIUM 4.3 UPGRADE A vulnerability was found in WeKan up to 8.20
• CVE-2026-1896 MEDIUM 6.3 UPGRADE A vulnerability has been found in WeKan up to 8.20
• CVE-2026-1895 MEDIUM 6.3 UPGRADE A flaw has been found in WeKan up to 8.20
• CVE-2026-1894 MEDIUM 6.3 UPGRADE A vulnerability was detected in WeKan up to 8.20
• CVE-2026-1892 MEDIUM 5.0 UPGRADE A security vulnerability has been detected in WeKan up to 8.20

FAQ

How do I fix wekan vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is wekan being exploited right now?

None of the tracked wekan CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which wekan CVE should I patch first?

CVE-2026-25560 currently ranks highest (53/100): WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication.

RSS feed for wekan · ← Back to latest CVEs