Technical impact
Wekan, an open‑source Kanban board built with Meteor, allows boards to have custom fields. Before version 9.32, the REST routes that create, update, or delete custom fields were protected with a read‑level authorization check (Authentication.checkBoardAccess) instead of the appropriate write‑level check (Authentication.checkBoardWriteAccess). As a result, users who are simply members with read‑only access could issue POST, PUT, or DELETE requests to /api/boards/:boardId/custom-fields and the related dropdown items endpoint, enabling them to create, modify, or delete custom fields on boards. This grants them elevation of privilege within the board, allowing unauthorized alteration of board data.
Affected Systems
Any deployment of Wekan that runs a version earlier than 9.32 is vulnerable. The CVE documentation does not specify a narrower base; therefore every release before 9.32, irrespective.
Risk and Exploitability
Exploitation requires an authenticated read‑only board member and the ability to send HTTP requests to the custom‑field API endpoints. The CVSS score of 6.5 indicates moderate severity, while the EPSS score of <1% reflects a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits at present, yet the privilege‑escalation nature warrants immediate attention.
