The vulnerability allows a malicious user to inject arbitrary LDAP filter content by supplying crafted usernames. This can alter the LDAP query executed during authentication, enabling an attacker to cause the system to authenticate without legitimate credentials or to retrieve unauthorized data.

All deployed versions of WeKan before 8.19 are affected. The issue is present in the WeKan product from the WeKan project, with no specific build or patch level mentioned beyond the 8.19 cutoff.

The CVSS score of 8.7 indicates a high severity, while the EPSS score of <1% signals a very low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the application’s authentication endpoint and the ability to supply a crafted username, which is commonly available to external attackers once the service is exposed over the network.