Wekan versions 8.31.0 through 8.33 expose all user fields through the notificationUsers publication. Because no filtering is applied, subscribers receive sensitive data such as bcrypt password hashes, session tokens, email verification tokens, full email addresses, and OAuth tokens. The weakness corresponds to information disclosure (CWE‑200) and improper authorization (CWE‑285). An attacker can harvest this data and use it for password cracking, session hijacking, and full account takeover, jeopardizing confidentiality and integrity of all affected accounts.

The vulnerability affects the open‑source kanban tool Wekan, specifically versions 8.31.0 to 8.33. The issue is present in all installations running those releases and is resolved in version 8.34 or later.

The CVSS score of 9.3 indicates critical severity, and the EPSS score of less than 1% suggests low current exploit probability. The vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated user to trigger the notificationUsers publication; any such user can harvest credentials of all other users. The lack of field filtering in the publication allows the entire user document to be exposed, making remediation urgent.