WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass

published 2026-02-07 9 mo ago modified 2026-07-14 3 mo ago also EUVD-2026-5704

cvss: 4.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement.

Patch / fix

fixed in 1 links 1

WeKan WeKan 8.19

github.com/wekan/wekan@7ed76c1 commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 8 mo ago (2026-02-09)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA	4.0	7.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

WeKan WeKan

Classification

Weakness

CWE-863 Incorrect Authorization

References

github.com /wekan/wekan/commit/7ed76c180ede46ab1dac6b8ad27e9128a272c2c8
patch
wekan.fi /
product
vulncheck.com /advisories/wekan-allowprivateonly-setting-enforcement-bypass
third-party-advisory

Sources

CVE List CVE-2026-25568
NVD CVE-2026-25568

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary