Wekan versions prior to 9.64 contain a cross‑board authorization bypass in the Meteor collection allow rules for Checklists and ChecklistItems. The flaw stems from updates being authorized only against the source card’s cardId; the destination cardId and boardId are not checked in the update modifier. A low‑privileged authenticated user who can write to one board and knows the id of a private card can therefore create checklist data on an accessible card and move it into a private board where they are not a member, resulting in unauthorized modification and potential data leakage.

The only affected vendor is Wekan, under the package wekan:wekan. The vulnerability is limited to the meteor collection allow rules for the Checklists and ChecklistItems collections and does not affect any other components of the application.

The CVSS score of 4.3 indicates a moderate severity vulnerability. The EPSS score of less than 1 % suggests a low probability that attackers will use this flaw in the wild. The vulnerability is not listed in the CISA KEV catalogue. Attackers with authenticated write access to one board and knowledge of a private card’s identifier can inject checklist data into an unrelated board and move the data into a private board where they lack membership, effectively bypassing board‑level access controls. This in‑application privilege escalation could lead to data exposure and unauthorized modification of private board content, but it does not allow remote code execution or compromise of the server OS. Exploitation requires the attacker to be authenticated and to have write permission on at least one accessible board.