The vulnerability is an insecure direct object reference in the card comment creation API of WeKan. An authenticated user can supply any authorId in the request body, and the system records that identifier as the author of the comment. This allows the attacker to masquerade as another user and subvert audit and accountability mechanisms. The weakness corresponds to CWE‑639.

The flaw affects all WeKan releases prior to version 8.19 distributed by the WeKan project. No sub‑version range is provided, so any build before 8.19 is considered vulnerable until a patch is applied.

The CVSS base score of 5.3 indicates medium impact, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability has not been catalogued by CISA as a known exploited vulnerability. According to the description, exploitation requires an authenticated session that can submit a comment‑creation request; the attacker must provide a valid authorId other than their own. No additional privileges or network bypasses are required. The impact is limited to author identity spoofing, which can undermine audit trails but does not grant further access or modify the underlying data.