WeKan Authorization Vulnerability Allowing Read-Only Users to Update Cards

A vulnerability exists in WeKan versions prior to 8.19, where certain card update API endpoints improperly validate authorization. These endpoints only check if a user has read access to a board, rather than requiring write permission. As a result, users with read-only roles can update cards in ways that should only be possible for users with write access.

Impact

Exploitation of this vulnerability allows users with read-only roles to update cards on boards, bypassing the intended access controls that restrict such actions to users with write permissions.

Remediation

Users can upgrade to WeKan version 8.19 or later to address this vulnerability.