Executive brief
WeKan, an open-source kanban board application, contains a security flaw in its integration management system. This vulnerability allows regular board members to perform administrative tasks they should not have access to, such as viewing, creating, or deleting webhooks and other third-party integrations. An attacker could use this to intercept sensitive data sent to external services or disrupt automated workflows.
Technical details
A missing authorization vulnerability (CWE-862) exists in the Integration REST API endpoints of WeKan. The flaw is located within the JsonRoutes REST handlers, which fail to properly verify the privilege level of authenticated users before allowing access to integration management functions. An attacker with standard board member permissions can exploit this to enumerate existing integrations (including webhook URLs), create new ones, or modify/delete existing configurations. The vendor has addressed this in version 8.35, which also includes protections against related Server-Side Request Forgery (SSRF) risks in integration URLs.
Affected products
- WeKan WeKan < 8.35
Timeline
- 2026-03-05: patched: Fix committed and version 8.35 released.
- 2026-04-22: disclosed: Initial advisory published.