Technical impact
Wekan is an open‑source Kanban board built with Meteor. Prior to version 9.32, the URLs for webhook integrations were stored directly from user input in the integrations model and later retrieved by the outgoing notifications code without applying the validateAttachmentUrl() private‑network checks defined in the attachment URL validation library. This omission allows a board administrator to configure a webhook URL that triggers the Wekan server to send HTTP requests to internal or metadata services. The server‑side request forgery can reveal internal network information or facilitate further attacks against internal resources. The vulnerability is classified as Server‑Side Request Forgery (CWE‑918).
Affected Systems
Any installation of Wekan running a version earlier than 9.32 is affected. The vulnerability operates regardless of the host operating system but requires the application to be accessible to a board administrator who can edit webhook settings. Versions 9.32 and later contain the fix and are no longer vulnerable.
Risk and Exploitability
The CVSS score of 6.2 indicates moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely under current conditions. Attackers must possess board‑administrator privileges to modify webhook URLs, which limits the attack surface to users with that role. Because the exploit produces outbound requests from the server, client users are not directly harmed, but internal services may be exposed. The vulnerability does not appear in the CISA KEV catalog, further indicating a lower risk profile for organizations that have been able to upgrade. Nonetheless, the potential impact on internal data or services warrants prompt remediation.
