CyberRota Analysis
AI-GeneratedWekan versions prior to 9.32 are vulnerable due to improper access controls in the REST API, allowing read-only board members to perform POST, PUT, and DELETE operations on custom fields. This could lead to unauthorized modifications of board data, potentially compromising the integrity of project management workflows. Organizations using Wekan should prioritize upgrading to version 9.32 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST, PUT, and DELETE handlers for /api/boards/:boardId/custom-fields and custom-field dropdown items to create, update, or delete board custom fields. This issue is fixed in version 9.32.