A missing authorization check in the Position‑History Tracking component of WeKan allows an attacker to manipulate history data without proper credentials. The flaw is documented as a breach of authorization and an absence of required access controls (CWE-862, CWE-863). An attacker who exploits this could read or alter position history records, potentially leaking sensitive user activity or corrupting task timelines.

The vulnerability affects the WeKan platform up to version 8.20, specifically the server/methods/positionHistory.js file in the Position‑History Tracking module. Installing WeKan 8.21 or newer removes the vulnerability.

The CVSS base score is 5.3, indicating moderate impact. The EPSS score is less than 1 %, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker can reach the affected endpoint remotely and perform the flaw without needing privileged credentials, making the attack vector remote.