WeKan prior to version 8.35 has a server‑side request forgery flaw in the webhook integration URL handling. The URL schema field accepts any string without protocol restriction or destination validation, allowing an attacker who can create or modify integrations to set webhook URLs that point to internal network addresses. When a board event triggers, the server makes an HTTP POST request to the attacker‑controlled internal target, sending the full event payload. The response from that target can then be used to overwrite any comment text on the board without authentication checks.

WeKan products running any version before 8.35 are affected. The vulnerability is present in all releases prior to the 8.35 release, which introduced proper validation of webhook URLs.

The CVSS score of 6.3 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to add or edit webhook integrations, a privilege that may be granted to board‑owners or higher‑level users. Once enabled, an attacker can harvest internal network information and alter board comments, potentially leading to data exfiltration and content tampering. The likelihood of exploitation depends on the setup; internal‑only targets mitigate external exposure, but the lack of protocol or destination checks makes any internal service reachable from the server.