High · published December 15, 2025
⚡ A sneaky flaw in Wekan's authorization check could turn your kanban board into a denial-of-service party! 🎉 Think of the upload API as a bouncer at a club. Instead of checking IDs, it assumes anyone with a token is on the guest list and lets them in, causing chaos on the dance floor when it can't handle the crowd. An attacker could flood the server with requests, leading to a denial of service. This means your users might be locked out, and on top of that, they could impersonate other users, wreaking havoc on your project management!
Think of the upload API as a bouncer at a club. Instead of checking IDs, it assumes anyone with a token is on the guest list and lets them in, causing chaos on the dance floor when it can't handle the crowd. This vulnerability allows the attachment upload API to misinterpret the Authorization bearer token as a userId, leading to a non-terminating handling branch that can be exploited for application-layer denial of service and identity spoofing.
An attacker could flood the server with requests, leading to a denial of service. This means your users might be locked out, and on top of that, they could impersonate other users, wreaking havoc on your project management! Upgrade Wekan to version 18.16 or later immediately to patch this vulnerability. Review your authorization logic to prevent similar oversights in the future, especially in user authentication processes. You've got this! Stay ahead of the game and keep your kanban board secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wekan_project/wekan | < 8.16 | 8.16 |