CVE-2025-65780
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-18
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wekan_project | wekan | to 8.16 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability in Wekan up to version 18.15 allows authenticated users to update their entire user document beyond just profile fields due to missing server-side authorization checks. This includes sensitive fields like organizations, teams, and loginDisabled status. As a result, users can escalate their privileges and gain unauthorized access to other teams or organizations. The issue was fixed in version 18.16 by restricting client-side updates to only safe fields and enforcing strict server-side permission checks. [2]
How can this vulnerability impact me? :
The vulnerability can lead to privilege escalation where an authenticated user can modify sensitive user data such as organization and team memberships or disable login flags. This unauthorized modification can allow the user to access boards and data from other teams or organizations they should not have access to, potentially exposing confidential information and disrupting organizational workflows. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability, you should check if your Wekan installation is running a version prior to 18.16, as the issue is fixed in version 18.16. Additionally, monitoring for unauthorized updates to user documents beyond allowed profile fields can indicate exploitation attempts. Since the vulnerability involves client-side updates to sensitive user fields, you can audit server logs or database changes for unexpected modifications to fields like orgs, teams, loginDisabled, roles, or isAdmin. Specific commands depend on your environment, but generally, you can query the database for user documents with recent changes in forbidden fields. For example, if using MongoDB, you might run queries to find user documents updated recently with changes in sensitive fields. However, no explicit detection commands are provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Wekan to version 18.16 or later, where this vulnerability is fixed. The fix restricts client-side updates to user documents to only safe fields (such as username and profile.*), blocking updates to sensitive fields like orgs, teams, roles, isAdmin, loginDisabled, and others. Additionally, ensure that admin operations and sensitive user data modifications are only performed via server methods with proper authorization checks. If upgrading immediately is not possible, consider restricting user permissions to prevent unauthorized updates and monitor for suspicious activity related to user document modifications. [2, 3]