A missing authorization flaw in WeKan versions prior to 8.35.0 allows authenticated attackers to perform unauthorized administrative actions on integration configurations, posing a significant risk to system integrity.

The vulnerability is caused by missing authorization checks in the Integration REST API endpoints. An authenticated board member can exploit this flaw to enumerate, create, modify, or delete webhook integrations without the required administrative privileges.

Successful exploitation of this vulnerability allows unauthorized modification of integration settings, which could lead to the exposure of sensitive webhook URLs or the disruption of critical business workflows. Given the CVSS score of 8.3, this high severity vulnerability represents a significant risk to the security posture of the board management platform. Unauthorized access to integration management may also facilitate further downstream attacks if webhook data is intercepted or redirected.

Immediate Action: Upgrade the WeKan installation to version 8.35.0 or later to apply the necessary authorization checks.

Proactive Monitoring: Monitor API access logs for anomalous patterns, specifically looking for unauthorized requests to integration-related REST endpoints from standard user accounts.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to restrict access to the REST API endpoints to authorized administrative IP ranges until the patch can be deployed.

Public Exploit Available: Unknown

This vulnerability presents a high risk to the administrative integrity of the WeKan platform by circumventing access control mechanisms. Organizations using affected versions should prioritize updating to version 8.35.0 immediately to eliminate the authorization bypass. Delaying this patch may allow malicious actors with valid board member credentials to manipulate system integrations and compromise the underlying data flow.