ID:13029 - Exploit for Missing Authorization in Wekan

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the automation rules bypass the cross-board deny rule. A remote user can write cards into private boards they are not a member of.

Remediation