WeKan releases before version 8.19 lack proper authorization checks in the attachment upload API. The API does not verify that the IDs supplied for board, card, swimlane, and list are consistent and refer to a legitimate, related set of objects. As a result, a user can upload an attachment and reference identifiers that do not belong together, effectively attaching data to objects that belong to other boards or users. This potential leak of information or unauthorized modification is an instance of the CWE-863 authorization bypass weakness, which could compromise confidentiality, integrity, and availability of the data stored on the system.

All installations of the WeKan project platform running versions earlier than 8.19 are vulnerable. This includes any deployment of the WeKan web application where users have access to the attachment upload API. No specific server or operating system versions are mentioned; the flaw resides purely in the application code.

The CVSS score of 7.1 reflects a medium to high severity risk. EPSS indicates an exploitation probability of less than 1%, suggesting that only a few attackers would target this issue, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to use the attachment upload API. Once validated, the attacker could inject attachments into unrelated cards or boards, which may lead to data exposure or other unintended effects. Overall, the risk is moderate but tangible, especially for installations with exposed APIs.