Executive brief
WeKan, an open-source Kanban board used for project management and task tracking, contains a security flaw in how it handles file attachments. An authenticated user could potentially view metadata for files attached to boards or cards they are not authorized to access. This could lead to the exposure of sensitive project details, file names, or organizational structures to unauthorized personnel.
Technical details
An information disclosure vulnerability exists in WeKan's 'attachmentsList' publication due to improper authorization checks (CWE-203/CWE-285). The server-side publication failed to validate if the requesting user had sufficient permissions to view the boards or cards associated with specific attachment metadata. A remote, authenticated attacker can exploit this by querying the attachments publication to retrieve metadata for files they should not be able to see. The vulnerability is addressed in version 8.19 by implementing a check that scopes results to boards where the user is either a member or the board is set to public.
Affected products
- WeKan WeKan < 8.19
Timeline
- 2026-02-07: advisory: Initial disclosure by VulnCheck
- 2026-02-07: patched: Fix committed in GitHub repository