Executive brief
WeKan, an open-source Kanban board application used for task management, contains a security flaw in how it handles file uploads. The system fails to verify that the specific board, card, and list identifiers provided during an upload actually belong together. This could allow an attacker to upload attachments to cards or boards they should not have access to, potentially leading to data integrity issues or unauthorized file placement within the organization's project management environment.
Technical details
An authorization weakness (CWE-863) exists in the attachment upload API of WeKan versions prior to 8.19. The root cause is a failure to validate the consistency of provided identifiers, including boardId, cardId, swimlaneId, and listId. An attacker can exploit this by providing mismatched identifiers that do not refer to a coherent card/board relationship, effectively bypassing intended scoping restrictions during file uploads. This allows for the attachment of files to objects outside of the expected organizational hierarchy. The vulnerability is reachable over the network and has been addressed in version 8.19.
Affected products
- WeKan WeKan versions prior to 8.19
Timeline
- 2026-02-07: disclosed
- 2026-02-07: advisory
- 2026-02-07: patched: Fixed in version 8.19