A critical vulnerability in Wekan versions up to 18.15 allows unauthenticated attackers to cause application-layer denial of service and perform identity spoofing via the attachment upload API.

The attachment upload API incorrectly processes the Authorization bearer token as a user identifier. This flaw allows an unauthenticated attacker to trigger a non-terminating body-handling loop or manipulate identity claims.

The ability for an unauthenticated user to trigger a non-terminating process creates an immediate risk of service disruption, directly impacting the availability of the kanban board system. Furthermore, the capacity for identity spoofing threatens the integrity of user data and collaboration workflows. With a CVSS score of 8.2, this vulnerability represents a high-severity risk that could lead to significant operational downtime and unauthorized access to project information.

Immediate Action: Update Wekan to version 18.16 or later, which includes the necessary fixes for the attachment upload API.

Proactive Monitoring: Monitor server CPU and memory utilization for abnormal spikes associated with incoming API requests and review application logs for suspicious Authorization header values.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming API requests and block payloads containing malformed or unexpected Authorization headers until the patch can be applied.

Public Exploit Available: Unknown

Given the high impact on service availability and the potential for identity manipulation, administrators should prioritize updating Wekan to version 18.16 immediately. If an immediate update is not feasible, implement strict request rate limiting and WAF filtering to mitigate the risk of denial of service attacks.