Executive brief
WeKan, an open-source project management tool, is affected by a security flaw in how it handles task checklists. An attacker can manipulate web requests to modify or delete checklists on boards they should not have access to. This could lead to unauthorized data modification or loss of project information, potentially disrupting business workflows and team collaboration.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in WeKan's checklist API routes (e.g., /api/boards/:boardId/cards/:cardId/checklists/:checklistId). The application fails to validate the relationship between the boardId and the cardId provided in the request. By manipulating these identifiers, an attacker can perform unauthorized actions on checklists across different boards. This bypasses intended authorization controls, allowing for the creation or deletion of checklists on cards that do not belong to the specified board. The issue is addressed in version 8.19 by implementing proper relationship verification between cards and boards.
Affected products
- WeKan WeKan < 8.19
Timeline
- 2026-02-07: advisory: Initial advisory published by VulnCheck
- 2026-02-07: disclosed
- 2026-02-07: patched: Fixed in version 8.19 via commit 08a6f08