Authorization bypass through user-controlled key in Wekan - #VU145036
Published: August 25, 2026
Vulnerability details
The vulnerability allows a remote user to inject a card they control into an arbitrary private board and disclose limited board structure information.
The vulnerability exists due to authorization bypass through a user-controlled key in the UserPositionHistory insert allow rule and undo() helper when processing a crafted userPositionHistory record and undo request. A remote user can insert a crafted history entry with an attacker-controlled previousBoardId and invoke undo to inject a card they control into an arbitrary private board and disclose limited board structure information.
The injected card may contain attacker-authored title, description, custom fields, and attachments, and it becomes visible in the victim board activity feed. Supplying valid previousListId or previousSwimlaneId values is required, and errors may reveal target board structure.