CVE-2026-25560
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate escaping, allowing an attacker to manipulate LDAP queries during authentication.
Risk Assessment
An attacker can bypass authentication, gain unauthorized access to the system, or perform LDAP injection attacks, potentially leading to data leakage or privilege escalation.
Recommendation
Immediately upgrade WeKan to version 8.19 or later, which includes a fix that eliminates the LDAP filter injection vulnerability.
Original NVD description (English source)
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate escaping, allowing an attacker to manipulate LDAP queries during authentication.