This vulnerability allows non-administrative users to invoke the migration functionality because the application performs insufficient permission checks. The result is that an attacker who is logged in with any valid account can initiate migration processes that may alter, delete, or reorganize board data, thereby compromising data integrity and potentially service continuity.

WeKan board instances running any version prior to 8.20 are affected. The flaw is embedded in the core migration module of the platform, which can be accessed via the web interface by all authenticated users. Admin privileges are not enforced when the migration API endpoint is called.

The CVSS score of 7.1 signals a medium‑to‑high severity, while the EPSS score of less than 1 % indicates that the likelihood of public exploitation is currently low. The flaw requires only an authenticated regular user, which an attacker can leverage via a web session or automated script from any remote machine with network access to the WeKan instance. The vulnerability is not listed in the CISA KEV catalog, and no effective exploits have been reported yet.