WeKan Information Disclosure Vulnerability in Attachments Publication

A vulnerability allowing information disclosure has been identified in WeKan versions prior to 8.19. This issue arises in the attachments publication, where metadata can be returned without properly restricting the results to boards and cards that the requesting user can access. As a result, there is a potential for unauthorized users to gain access to attachment metadata.

Impact

Exploitation of this vulnerability could lead to unauthorized access to attachment metadata, creating a risk of exposing sensitive information to users who should not have access.

Remediation

Users can upgrade to WeKan version 8.19 or later to address this vulnerability.