WeKan Insecure Direct Object Reference Vulnerability Allowing Comment Author Spoofing

A vulnerability exists in WeKan versions prior to 8.19, where an insecure direct object reference (IDOR) is present in the card comment creation API. The issue allows authenticated users to spoof the author of a comment by providing another user's author ID. This vulnerability arises because the API endpoint accepts user-controlled author IDs in the request body, enabling the manipulation of comment attribution.

Impact

Exploitation of this vulnerability allows for unauthorized modification of comment authorship, potentially leading to misinformation or misrepresentation of user contributions within the application.

Remediation

Users can upgrade to WeKan version 8.19 or later to address this vulnerability.