CVE-2025-65780
📋 TL;DR
Authenticated users in Wekan versions up to 18.15 can modify their entire user document, including organization/team memberships and account status fields, due to missing server-side authorization checks. This allows privilege escalation and unauthorized access to other teams and organizations. All Wekan instances running vulnerable versions are affected.
💻 Affected Systems
- Wekan
📦 What is this software?
Wekan by Wekan Project
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could grant themselves administrative privileges, disable other users' accounts, access all organizations/teams, and potentially take full control of the Wekan instance.
Likely Case
Malicious users or compromised accounts escalate privileges to access restricted teams/organizations, steal sensitive kanban data, or disrupt operations by disabling other users.
If Mitigated
With proper network segmentation and monitoring, impact is limited to unauthorized access within the Wekan application scope.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is in the user update API endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.16
Vendor Advisory: https://wekan.fi/hall-of-fame/spacebleed/
Restart Required: Yes
Instructions:
1. Backup your Wekan data and configuration. 2. Update Wekan to version 18.16 or later using your deployment method (Docker, Snap, etc.). 3. Restart the Wekan service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict User Update API
allImplement a web application firewall or reverse proxy rule to block or monitor requests to user update endpoints.
🧯 If You Can't Patch
- Implement strict network access controls to limit Wekan access to trusted users only.
- Enable detailed logging of all user modification actions and monitor for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check your Wekan version. If it's 18.15 or earlier, you are vulnerable.Check Version:
Check the Wekan admin panel or run: docker inspect wekan/wekan | grep WEKAN_VERSIONVerify Fix Applied:
After updating, confirm the version is 18.16 or later and test that user profile updates are properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual user document modifications
- Multiple privilege escalation attempts
- User accounts being disabled unexpectedly
Network Indicators:
- HTTP POST/PUT requests to user update endpoints with unusual parameters
SIEM Query:
source="wekan" AND (event="user_update" OR event="profile_update") AND (params INCLUDES "loginDisabled" OR params INCLUDES "orgs")