WeKan Authorization Logic Vulnerability Allowing Private Board Setting Bypass

A vulnerability exists in WeKan versions prior to 8.19, where the authorization logic related to the 'allowPrivateOnly' setting is not properly enforced during board creation. When 'allowPrivateOnly' is activated, users can still create public boards due to inadequate server-side validation.

Impact

Exploitation of this vulnerability allows users to create public boards even when the 'allowPrivateOnly' setting is enabled, bypassing intended access controls.

Reproduction

To reproduce this vulnerability, enable the 'allowPrivateOnly' setting in the WeKan instance configuration. Then, create a new board and set its permission to public. The board will be created successfully, despite the 'allowPrivateOnly' setting being active, demonstrating the bypass of the authorization logic.

Remediation

Users can upgrade to WeKan version 8.19 or later, where this vulnerability has been addressed.