WeKan versions before 8.19 suffer from an authorization flaw that causes the card update API to perform only a board read‑access check instead of verifying the user’s write permission. This means any user granted just a read‑only role on a board can modify card details such as titles, content, and timestamps. The weakness is a classic case of insufficient authorization (CWE‑863), leading to integrity violations within project boards.

The vulnerability affects the WeKan project’s board management functionality in all releases prior to 8.19. Users who interact with a WeKan board via the web interface or the API may be impacted if they have been assigned a read‑only board role.

The CVSS base score of 7.1 reflects a high severity due to the potential for significant data tampering. The EPSS score is reported as < 1 %, indicating that, at the time of assessment, the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to combine legitimate authentication with the exposed API endpoints that permit card updates, indicating a remote, “network” level attack vector that is inferred from the API context. Successful exploitation could allow an attacker to alter project data or undermine board integrity, potentially compromising project workflow and reporting.