Executive brief
WeKan is an open-source Kanban board application used for project management and task tracking. A security flaw in versions prior to 8.19 allows users to create public boards even when administrators have configured the system to only allow private boards. This could lead to sensitive project information being unintentionally exposed to the public or unauthorized users, potentially compromising corporate data and operational privacy.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in WeKan's board creation logic. The 'allowPrivateOnly' configuration setting, intended to restrict board visibility to private-only across an instance, is not properly validated on the server side during the board creation process. A remote, authenticated user can bypass this restriction to create boards with public visibility. This issue stems from incomplete enforcement in the server-side models, specifically within 'models/boards.js'. The vulnerability is addressed in version 8.19 by implementing stricter server-side checks on visibility mode settings.
Affected products
- WeKan WeKan < 8.19
Timeline
- 2026-02-07: disclosed
- 2026-02-07: patched: Fixed in version 8.19
- 2026-02-07: advisory