WeKan Insecure Direct Object Reference Vulnerability in Checklist Creation

A vulnerability allowing insecure direct object reference (IDOR) has been identified in WeKan versions prior to 8.19. This issue arises in the checklist creation process and related checklist routes, where the application fails to verify that the provided cardId is associated with the specified boardId. This lack of validation enables cross-board ID tampering by simply manipulating the identifiers.

Impact

Exploitation of this vulnerability allows for cross-board ID tampering, potentially leading to unauthorized access or modification of checklist data across different boards.

Remediation

Users can upgrade to WeKan version 8.19 or later to address this vulnerability.