A weakness exists in the Activity Publication Handler of WeKan up to version 8.20, specifically in the file server/publications/activities.js. The flaw allows an attacker to manipulate the processing of the file, resulting in an unauthorized disclosure of sensitive information. It is possible for the attacker to launch this exploit remotely, meaning that the vulnerability is publicly exploitable without local user interaction.

WeKan Project software versions up to and including 8.20 are affected. All installations that have not yet migrated to version 8.21 contain the vulnerable component and therefore are at risk.

The CVSS score of 6.9 indicates a moderate severity vulnerability, and the EPSS score of less than 1% implies a low but non-zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the attack can be performed remotely and does not require additional user interaction, the overall risk to organizations using vulnerable WeKan installations remains significant, especially if sensitive data is exposed through the publication feature.