The ComprehensiveBoardMigration function in WeKan’s migration module accepts a boardId parameter without enforcing proper authorization checks. By manipulating boardId remotely, an attacker can trigger migration of any board, potentially exposing data or escalating privileges. This flaw is an improper access control weakness that can be abused from outside the application without needing local access. The vulnerability is a CWE-284 access control failure, and a CVSS score of 5.3 indicates a medium severity impact on confidentiality and integrity.

All WeKan installations running version 8.20 or earlier are affected. The issue resides in the server/migrations/comprehensiveBoardMigration.js file within the Migration Operation Handler. The fix is included in WeKan release 8.21, corresponding to patch commit cc35dafef57ef6e44a514a523f9a8d891e74ad8f.

The CVSS score of 5.3 places this flaw in the medium severity range, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by sending crafted migration requests with a manipulated boardId, provided the target allows external access to the migration endpoint. Proper authentication or authorization is insufficient to prevent abuse, so the attack path is straightforward for any host with internet exposure and a vulnerable WeKan instance.