The vulnerability in WeKan versions earlier than 8.19 allows the retrieval of attachment metadata without enforcing scoping rules based on the board or card permissions of the requesting user. This flaw can expose details such as file names, paths, upload times, or other sensitive metadata to users who should not have visibility, leading to unintended data leakage.

All installations of the WeKan project running a version below 8.19 are affected. The issue was present in every build prior to 8.19 and has been addressed in release 8.19 and later. No specific patch-level subdivision is detailed beyond the version boundary.

The CVSS base score of 5.3 classifies this as a medium impact. The EPSS score is under 1%, indicating a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, and the attack vector is inferred to be remote via the web interface or API, assuming an authenticated user can target the attachments endpoint. Exploitation would likely require the attacker to have a user account with some level of access to the application, but the flaw permits leaking metadata for objects outside their authorized scope.