The flaw lies in WeKan’s webhook integration URL handling before version 8.35. The URL scheme field accepts any string without protocol restrictions or target validation, enabling an attacker who can create or modify integrations to point webhook URLs at internal network addresses. When a board event triggers, the server issues an HTTP POST request to the attacker‑controlled target, sending the full event payload. The response from that target can be exploited to overwrite arbitrary comment text on the board without any authorization checks.

WeKan products running any version before 8.35 are affected. The vulnerability is present in all releases prior to the 8.35 release, which introduced proper validation of webhook URLs.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is <1% (0.00034), reflecting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to add or edit webhook integrations, a privilege that may be granted to board‑owners or higher‑level users. Once enabled, an attacker can harvest internal network information and alter board comments, potentially leading to data exfiltration and content tampering. The likelihood of exploitation depends on the setup; internal‑only targets mitigate external exposure, but the lack of protocol or destination checks makes any internal service reachable from the server.