Wekan Cross-Board Write Vulnerability Allows Unauthorized Access to Private Boards

A broken access control vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This issue affects versions through 9.36. The vulnerability arises because the DDP update allow rules for Cards, Lists, and Swimlanes only verify the current 'boardId' of a document, which reflects the attacker's own board. They do not validate the new 'boardId' being set in the update modifier. As a result, any authenticated user with write access to their own board can manipulate the 'boardId' of cards, lists, or swimlanes, transferring them to a private board they do not belong to. This exploitation bypasses board-level access controls, allowing users to inject arbitrary content into boards they cannot access or read.

Impact

Exploitation of this vulnerability allows authenticated users to move their cards, lists, or swimlanes into private boards they are not members of, effectively bypassing access controls and injecting content into restricted areas.

Reproduction

To reproduce this vulnerability, an authenticated user must send a DDP update request to the '/cards/update', '/lists/update', or '/swimlanes/update' endpoints. The request must include a modifier that sets the 'boardId' to a private board the user does not belong to. This can be done by first creating a private board as an admin, then using an existing document (card, list, or swimlane) to perform the update. The DDP allow rules will approve the modification, and the document will be relocated to the unauthorized board.

Remediation

Users can update to Wekan version 9.37 or later, where this vulnerability has been fixed.