Wekan Unauthenticated Board Sort Update Vulnerability Allowing Arbitrary Reordering

A vulnerability exists in Wekan, the open-source kanban board system, in versions prior to 18.15. It allows unauthenticated users to update a board's sort value, as the permission check does not verify user identity. This flaw enables arbitrary reordering of boards.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in board order, potentially disrupting user organization and workflow.

Reproduction

To reproduce this vulnerability, access a Wekan instance running a version prior to 18.15. Navigate to the 'All Boards' or 'Public Boards' page. Without authentication, send a request to update the sort value of a board. The change will be applied, demonstrating the lack of proper user verification.

Remediation

Users can update to Wekan version 18.16 or later, where this vulnerability has been fixed.