A flaw in the Attachment Storage component of WeKan allows an attacker to bypass authorization checks for handling attachments. The vulnerability exists in the models/attachments.js module and can be triggered by manipulating requests, enabling unauthorized reading, uploading or deletion of attachments. This weakness aligns with CWE-266 and CWE-284 and threatens the confidentiality and integrity of stored attachments. Because the description indicates the attack may be launched remotely, an attacker only needs to send crafted traffic to a vulnerable WeKan instance.

Versions of WeKan up to and including 8.20 are affected. The vendor addressed the flaw in release 8.21, with the patch identified by commit c413a7e860bc4d93fe2adcf82516228570bf382d. All installations running 8.20 or earlier are vulnerable and the issue is confined to the Attachment Storage component.

The CVSS base score of 5.3 classifies the issue as medium severity, while an EPSS score below 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, involving a specially crafted request to the attachments endpoint, which could allow an attacker to access or modify confidential attachments.