The flaw lies in the setCreateTranslation function within the Custom Translation component of WeKan. A remote attacker can manipulate this function, bypassing the intended access controls and creating translations without proper authorization. This permits unauthorized users to add or modify translation entries, potentially exposing sensitive information or altering application behavior. The weakness is catalogued as CWE‑266 and CWE‑285, indicating a lack of role‑based access enforcement.

WeKan versions up to 8.18 are affected. The vendor, WeKan Project, releases the product under the identifier wekan_project:wekan. Upgrading to version 8.19, available through the official release repository, resolves the issue.

The CVSS score of 5.3 classifies the vulnerability as moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. However, the attack vector is remote, requiring only network access to the WeKan instance. The proper authorization check is missing, so any authenticated user could potentially trigger the exploit if they have write privileges in the affected component. Consequently, while the likelihood of exploitation remains low, the impact of unauthorized translation creation warrants prompt remediation.