The flaw lies in the applyWipLimit function of WeKan’s Attachment Storage Handler. Manipulating requests that invoke this function allows an attacker to bypass the intended access restrictions on list attachments, exposing sensitive files to unauthorized users. The weakness is a classic example of improper access control, corresponding to CWE‑266 and CWE‑284, and causes potential confidentiality and integrity violations without providing code execution. The problem is limited to data exposure and does not affect system availability.

WeKan installations up to version 8.20 are affected. All deployments that include the open‑source project WeKan are vulnerable until the fix in release 8.21, which incorporates commit 8c0b4f79d8582932528ec2fdf2a4487c86770fb9, is applied.

The CVSS score of 5.3 labels the vulnerability as moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. According to the description, the attack can be executed remotely with crafted requests to the web service; no local privileges are required to reach the flaw. The attacker can trigger the improper access control by targeting the applyWipLimit endpoint and gain unauthorized access to attachment data.