CVE-2026-25560 is an LDAP filter injection flaw in WeKan, the open source kanban board, rated critical at 9.8. Usernames are placed into LDAP search filters without escaping during login. Versions before 8.19 are affected, so upgrade to 8.19 or later.
What's affected
- Product: WeKan, with LDAP authentication enabled.
- Affected: versions before 8.19.
- Fixed: 8.19 or later, as stated in the VulnCheck advisory; confirm against the project release notes.
- Not affected by this CVE: instances that do not use LDAP login.
How to check if you're exposed
First find out whether LDAP is on. In the WeKan environment or snap configuration look for the LDAP enable variable, and check the version shown in the UI or your deployment:
docker inspect wekan --format '{{.Config.Image}}'
snap list wekan
If LDAP login is enabled and the version is older than 8.19, you are in range.
What to do now
- Upgrade WeKan to 8.19 or later.
- If you cannot upgrade immediately, disable LDAP login or restrict the login page to your internal network.
- Review authentication logs for usernames containing LDAP filter characters such as parentheses, asterisks or ampersands.
- Check the bind account WeKan uses and cut its directory permissions to read only on the needed subtree.
- Confirm no unexpected accounts were created in WeKan.
Why it matters
The flaw is LDAP injection, CWE-90. User input becomes part of the filter, so a person can change what the directory query means. In an authentication path, that can let a login succeed or return other entries.
The remedy is escaping or parameterising filter values, exactly as with SQL. A 9.8 score reflects no privileges and no user interaction. The record does not mark exploitation in the wild, and the CVE is not in CISA KEV.
Quick check
I use snap or Docker updates. Am I covered?
Only if the channel or tag you follow has reached 8.19 or later. Check the running version, not the update setting.
Sources
Last reviewed: 19 October 2026.
