A vulnerability exists in WeKan versions up to 8.20 in the Meteor Publication Handler file server/publications/cards.js. By manipulating the publication request, an attacker can retrieve internal card data that should not be publicly exposed, resulting in the disclosure of potentially sensitive information. The description indicates that the attack can be performed remotely.

The affected vendor is WeKan, project name WeKan. All releases up to version 8.20 are vulnerable. Upgrading to version 8.21, which contains commit 0f5a9c38778ca550cbab6c5093470e1e90cb837f, eliminates the issue.

The CVSS score of 5.3 classifies the weakness as moderate. The EPSS score of less than 1 percent reflects a very low exploitation probability as of the last assessment, and the issue is not listed in the CISA KEV catalog. Exploitation requires remotely manipulating the Meteor publication endpoint that serves card data; no local privilege escalation or credential compromise is mentioned. Therefore, the primary risk is the exposure of data rather than denial of service or code execution.