The flaw stems from an incomplete enforcement of the instance configuration setting allowPrivateOnly during board creation. When the setting is enabled, the server fails to block the creation of public boards, allowing any authenticated user with board‑creation privileges to publish a board publicly. This bypass enables the disclosure of data that should remain private and undermines the intended privacy controls of the system. The weakness is identified as CWE‑863: Insufficient Authorization Checks.

WeKan web application versions earlier than 8.19, as used by community and enterprise deployments of the WeKan project, are affected.

The vulnerability carries a CVSS v3 base score of 7.1, indicating a high impact when exploited. An EPSS score of less than 1 % indicates a low probability of widespread exploitation at this time, and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with permission to create boards; the attacker would simply submit a board‑creation request via the UI or API while the allowPrivateOnly setting is true. Successful exploitation results in the creation of a public board that can be accessed by anyone, potentially exposing sensitive information.