High · published December 15, 2025
🚨 An unauthorized user can simply rearrange your entire project board with a click — no magic password required! ⚡ Think of it like a restaurant where anyone can swap the tables around at will, turning your carefully organized dining setup into total chaos! 🍽️ An attacker could unscrupulously reorder boards in Wekan, potentially leading to confusion, miscommunication, and disruption in your team's workflow. Imagine important tasks getting buried under less urgent ones — a recipe for disaster! 🔥
Think of it like a restaurant where anyone can swap the tables around at will, turning your carefully organized dining setup into total chaos! 🍽️ This vulnerability arises because the Wekan board system allows unauthenticated users to change the 'sort' value of boards, as it trusts the Boards.allow function without verifying the userId.
An attacker could unscrupulously reorder boards in Wekan, potentially leading to confusion, miscommunication, and disruption in your team's workflow. Imagine important tasks getting buried under less urgent ones — a recipe for disaster! 🔥 Upgrade to Wekan version 18.16 or later immediately to close this loophole. Additionally, consider implementing stronger access control measures to prevent unauthorized board manipulation. Regularly audit your system for similar vulnerabilities! 🛡️ You've got this! Follow these steps, and you’ll reclaim control over your boards in no time! 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| wekan_project/wekan | < 8.16 | 8.16 |