Wekan’s board composite publication exposed all integration data, including webhook URLs and authentication tokens, to any subscriber. The vulnerability, identified as a lack of field filtering, allowed users with board access – even those with read‑only or comment‑only roles – to retrieve sensitive configuration data. This data leak enables attackers to perform unauthenticated requests to exposed webhooks, potentially causing unauthorized actions in external services and representing a clear confidentiality breach consistent with CWE‑200 and CWE‑862.

The affected product is Wekan, specifically versions 8.31.0 through 8.33. All boards in these releases, regardless of visibility, were susceptible; public boards exposed the bug to unauthenticated DDP clients, while any board member could exploit the flaw. The issue was addressed in release 8.34.

The CVSS score of 6.9 indicates a medium severity vulnerability, and the EPSS of <1% suggests a low exploitation probability in general. The bug is not listed in the CISA KEV catalog. Exploitation requires the ability to subscribe to a board’s publication, which can be achieved by any board member or an unauthenticated DDP client on a public board. The attack vector is thus network‑based, relying on ordinary board access privileges.