CVE-2025-65782
📋 TL;DR
An authorization flaw in Wekan's card update handling allows authenticated board members to manipulate vote arrays by adding/removing arbitrary user IDs. This enables vote forgery and unauthorized voting, affecting all Wekan instances running versions up to 18.15.
💻 Affected Systems
- Wekan
📦 What is this software?
Wekan by Wekan Project
⚠️ Risk & Real-World Impact
Worst Case
Malicious board members could manipulate voting outcomes on critical decisions, compromise board integrity, and potentially escalate privileges by manipulating administrative votes.
Likely Case
Board members manipulating votes to influence decisions, create false consensus, or disrupt collaborative workflows.
If Mitigated
Limited to authenticated users with board access, with minimal impact if voting features are not heavily used.
🎯 Exploit Status
Exploitation requires authenticated access to a board, but manipulation is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.16
Vendor Advisory: https://wekan.fi/hall-of-fame/spacebleed/
Restart Required: Yes
Instructions:
1. Backup your Wekan data and configuration. 2. Update Wekan to version 18.16 or later using your package manager or deployment method. 3. Restart the Wekan service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable voting functionality
allTemporarily disable voting features to prevent exploitation while planning upgrade.
Modify Wekan configuration to disable voting (specific method depends on deployment)
🧯 If You Can't Patch
- Restrict board access to trusted users only and monitor for unusual voting patterns.
- Implement network segmentation to isolate Wekan instances from critical systems.
🔍 How to Verify
Check if Vulnerable:
Check Wekan version via admin panel or by examining the running container/process. Versions ≤18.15 are vulnerable.Check Version:
Check Wekan admin interface or run: docker inspect wekan/wekan | grep WEKAN_VERSION (if using Docker)Verify Fix Applied:
Confirm version is 18.16 or later and test that board members cannot manipulate other users' votes.📡 Detection & Monitoring
Log Indicators:
- Unusual vote manipulation patterns in Wekan logs
- Multiple vote updates from single user in short timeframe
Network Indicators:
- HTTP POST requests to card update endpoints with modified vote arrays
SIEM Query:
source="wekan" AND (message="vote.positive" OR message="vote.negative") AND user_id!="current_user"