The vulnerability resides in the card move logic of WeKan and is categorized as an authorization error (CWE‑863). A properly authenticated user can force a card to move to any board, list, or swimlane without the necessary permission checks against the destination. Consequently, an attacker who can control the destination parameters could transfer cards across boards they do not own, potentially leaking sensitive information or disrupting workflows.

WeKan releases prior to version 8.19 are affected. The issue is present in the core code base and can be exercised by any user who has access to the application, regardless of the board to which they intend to move the card.

The CVSS score of 7.1 indicates a high impact security flaw. The exploit probability is very low (EPSS < 1%) and the vulnerability is not listed in CISA's KEV catalog, suggesting it has not been widely exploited yet. The likely attack vector involves a user interacting with the application UI or API to submit a move request with a fabricated destination. A successful exploit would grant the attacker the ability to move cards in ways they are not authorized to, compromising confidentiality and integrity of data across boards.