Detections
Analytics
CVE-2025-65781
high
Description
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing.
References
https://wekan.fi/hall-of-fame/spacebleed/
https://github.com/wekan/wekan/commit/ccd90343394f433b287733ad0a33c08e0a71f53c
https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release