A vulnerability in older WeKan releases allows an attacker to create or modify checklists by manipulating card identifiers that are not verified against the associated board. The flaw is an insecure direct object reference, meaning that malicious users can tailor requests to reference objects belonging to other boards. This can lead to unauthorized data modification or insertion, potentially exposing or altering information without permission. The weakness is classified as CWE‑639.

All WeKan deployments running a version earlier than 8.19 are affected. The issue resides in the checklist creation endpoint and related routes that do not enforce ownership checks between cardId and boardId. System administrators should evaluate their current version and whether any boards contain sensitive or restricted data that could be exposed through this flaw.

The vulnerability carries a CVSS score of 7.1, indicating a moderate to high severity. Exploitation probability is low, with an EPSS score of less than 1%, and the flaw is not listed in the CISA KEV catalog. The likely attack path involves authenticated users sending crafted API requests or URLs that reference arbitrary cardIds on other boards. Adequate authentication is required, but once authenticated, an attacker can exploit the missing reference checks to tamper with cross‑board checklists.