Wekan Project vulnerabilities
We track 4 vulnerabilities in Wekan Project products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 15, 2025.
Latest Wekan Project vulnerabilities
- 8.2 High severity
Wekan: Improper Authentication
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token,
- 8.8 High severity
Wekan: Improper Access Control
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side auth
- 7.5 High severity
Wekan: Improper Access Control
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow returns true without verifying userId), allowing arbitrary reordering of boards.
- 8.1 High severity
Wekan: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's