Executive brief
WeKan, an open-source Kanban board application used for project management, contains a security flaw where standard users can access administrative migration tools. An attacker with a basic user account could trigger unauthorized data migration operations, potentially leading to data loss, service disruption, or unauthorized modification of project boards. This undermines the platform's access controls and could impact business operations and data integrity.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in WeKan versions prior to 8.20. The application fails to perform sufficient permission checks on its migration functionality, allowing authenticated users without administrative privileges to access and execute migration tasks. An attacker with low-privileged network access can exploit this to perform unauthorized migration operations, which may impact the integrity and availability of the system's data. The issue was addressed in version 8.20 by moving migration controls to the Admin Panel and implementing proper access checks.
Affected products
- WeKan WeKan < 8.20
Timeline
- 2026-02-07: disclosed: Initial disclosure by VulnCheck
- 2026-02-07: advisory: NVD publication date
- 2026-02-07: patched: Fix commit cbb1cd7 identified in version 8.20