A flaw in Wekan’s DDP update allow rules permits any authenticated user with write access on their own board to move cards, lists, or swim lanes into other boards that they are not a member of. This bypass of authorization validation enables the attacker to alter data on private boards, creating integrity and confidentiality violations. The weakness corresponds to lack of proper permission checks (CWE‑284) and excessive influence over other user resources (CWE‑639).

The vulnerability affects all Wekan installations running a version older than 9.37. Any installation not upgraded to 9.37 or later is susceptible, regardless of hosting environment, because the boardId validation is embedded in the server permissions modules.

With a CVSS score of 8.5, the issue is considered high severity. The EPSS score of less than 1 % indicates low probability of current exploitation, and it is not listed in the CISA KEV catalog. Attack requires only authentication and write access to an owner’s board, which is a relatively common configuration. Once exploited, an attacker can move sensitive items into private boards, disrupting data integrity and potentially exposing information to unintended users. The fix in 9.37 removes the lack of validation and restores proper authorization boundaries.