A flaw exists in the file server/attachmentMigration.js component of WeKan, allowing an attacker to bypass normal access controls. The vulnerability is caused by an unknown function that does not enforce proper permission checks before processing attachment migrations. An attacker can therefore access or manipulate attachments intended to be restricted, potentially exposing sensitive data or altering attachment content. The weakness aligns with CWE‑266 (Privilege Escalation) and CWE‑284 (Improper Access Control).

All installations of the WeKan project up to version 8.20 are affected. The vendor, WeKan, publishes the issue in their releases and provides a patch in version 8.21, identified by commit 053bf1dfb76ef230db162c64a6ed50ebedf67eee. Users running earlier releases should update to 8.21 or apply the specific patch commit.

The CVSS v3.1 score of 5.3 places the vulnerability in the moderate severity range, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability can be triggered remotely, and it is not listed in the CISA KEV catalog. Given the moderate impact and low exploitation likelihood, the overall risk is considered moderate, but it remains important to remediate promptly to eliminate the potential for unauthorized data access.