CVE-2026-25568 — WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass
WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creatio…
Published: 2026-02-07 · CVSS: 7.1 · CVSS 4.0
WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7