Executive brief
WeKan, an open-source project management tool, contains a security flaw in how it handles moving tasks between different project boards. An authorized user could move tasks into boards or lists they do not have permission to access by bypassing authorization checks. This could lead to unauthorized data modification or organizational disruption by placing information in restricted areas.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the card movement logic of WeKan versions prior to 8.19. The application failed to perform adequate authorization checks on the destination board and did not validate that destination objects (lists or swimlanes) actually belonged to the specified destination board. A remote authenticated attacker can exploit this by specifying a destination board/list/swimlane they are not authorized to access, enabling unauthorized cross-board moves. The issue was addressed in version 8.19 by adding 'Authentication.checkBoardAccess' and validating the existence and ownership of destination lists.
Affected products
- WeKan WeKan prior to 8.19
Timeline
- 2026-02-07: advisory: Initial advisory published by VulnCheck
- 2026-02-07: patched: Fix committed to GitHub repository