CyberRota Analysis
AI-GeneratedWekan versions prior to 9.37 are vulnerable to improper authorization, allowing authenticated users with write access to their own boards to manipulate cards, lists, or swimlanes and move them into private boards they do not belong to. This could lead to unauthorized access to sensitive information and disruption of board organization. Organizations using Wekan should prioritize upgrading to version 9.37 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and server/permissions/swimlanes.js authorize against the stored source boardId and do not validate a new boardId in the update modifier. Any authenticated user with write access to their own board can call /cards/update, /lists/update, or /swimlanes/update to move cards, lists, or swimlanes into a private board they are not a member of. This issue is fixed in version 9.37.