A vulnerability exists in the WeKan application up to version 8.20 in the REST Endpoint defined in models/boards.js. The flaw occurs when an attacker manipulates a known or unknown function related to board titles, leading to improper access control enforcement. Because the authorization check is bypassed, a remote attacker can read or modify board titles belonging to other users. This is a classic access control issue (CWE-266, CWE-284).

The affected product is the WeKan project application. All releases through 8.20 are vulnerable. An update to v8.21 includes the patch commit 545566f5663545d16174e0f2399f231aa693ab6e and resolves the problem.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1 percent suggests a low current exploitation probability. The vulnerability is not listed in the KEV catalog. Exploitation requires the ability to send crafted REST requests to the affected endpoints; an attacker who can reach the server can remotely trigger the flaw. Due to the low EPSS and lack of known exploits, the risk is moderate but should still be addressed.