Technical impact
WeKan versions before 8.35 suffer from a missing authorization flaw in the Integration REST API. Authenticated board members can use the JsonRoutes endpoints to enumerate, create, modify, or delete integrations—including webhook URLs—without proper privilege verification. This flaw falls under CWE‑862 and allows board members to perform actions that should be restricted to administrators, potentially exposing sensitive data or enabling further malicious activity.
Affected Systems
The vulnerability affects the WeKan board management application (WeKan) from vendor wekan. All instance versions below 8.35 are susceptible, while 8.35 and later contain the fix.
Risk and Exploitability
The flaw carries a CVSS score of 8.7, indicating high severity. No EPSS score is available, but the vulnerability is not listed in CISA KEV. The attack vector is inferred to be the REST API, where an attacker only needs authenticated board‑member credentials to manipulate integrations. Once the API is accessed, the attacker can execute administrative actions that are otherwise protected.
