An insecure direct object reference in Wekan’s custom‑field update endpoints allows an authenticated user to alter fields on boards they do not own. The flaw occurs because the API verifies board membership before the database update, but the update step filters only by the custom field ID, not by the board it belongs to. Consequently, a malicious user can supply the ID of any custom field on another board and change its values or delete it, leading to unauthorized data manipulation. The vulnerability is classified as CWE‑639.

Wekan, identical to the open‑source project name. Versions 8.32 and 8.33 are affected. The issue has been fixed in version 8.34 and later.

The vulnerability has a CVSS score of 9.3, indicating high severity. However, the EPSS score is below 1%, suggesting that exploitation attempts are expected to be rare. The flaw is not listed as a Known Exploited Vulnerability in CISA’s KEV catalog. Attackers need only a legitimate account with access to any board to abuse the flaw; they can then obtain other boards’ custom field IDs by exporting a board that they have read access to. With those IDs, the attacker can construct requests to the PUT, POST, or DELETE custom‑field endpoints and manipulate data on arbitrary boards.