In Wekan versions prior to 9.89 an insecure server‑side allow rule let any board member— even comment‑only or read‑only users— perform a Boards.update that changed the sort order. Because Meteor combines allow rules with OR semantics and applies the full modifier, the rule permitted the attacker to choose themselves as sole board administrator, thereby gaining full control of the board. The attacker could then expose private board content, remove the legitimate owner, and take over the board entirely. The flaw is an authority bypass (CWE‑269) and a missing authorization check (CWE‑863).

All Wekan instances running any version older than 9.89 are affected, regardless of deployment method or location.

The vulnerability carries a CVSS score of 8.8, indicating high severity. The EPSS score is not available, but the exploit is straightforward because any board member can send the malicious update through normal application functionality. The issue is not listed in the CISA KEV catalog. Attackers only need to be a member of a board, even with minimal rights, and the problem is mitigated only by upgrading to 9.89 or later.