ID:13032 - Exploit for Missing Authorization in Wekan

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing write-level authorization check within the ensureDefaultSwimlane Meteor method. A remote user can alter board structure beyond their intended permissions.

Remediation