CyberRota Analysis
AI-GeneratedWekan versions prior to 9.64 are vulnerable to a cross-board authorization bypass, allowing low-privileged authenticated users to manipulate checklist data by moving it to private boards without proper authorization checks. This could lead to unauthorized access to sensitive information on private cards. Organizations using Wekan should prioritize upgrading to version 9.64 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. Prior to 9.64, Wekan has a cross-board authorization bypass in the direct Meteor collection allow rules for Checklists and ChecklistItems because updates are authorized only against the current source doc.cardId and do not inspect the destination cardId or boardId in the update modifier, allowing a low-privileged authenticated user with write access to one board and knowledge of a target private card id to create checklist data on an accessible card and move it into a private board where they are not a member. This issue is fixed in version 9.64.