WeKan versions prior to 8.35.0 are vulnerable to a server-side request forgery (SSRF) flaw that permits unauthorized internal network scanning and data manipulation.

The application fails to validate the protocol or destination of webhook integration URLs, allowing an authenticated user with permission to manage integrations to trigger server-side HTTP requests against internal infrastructure. Furthermore, the vulnerability allows for the unauthorized modification of existing comment text within the application.

The ability to perform SSRF allows attackers to probe internal network segments, potentially exposing services or data stores that are not intended for public access. Given the CVSS score of 8.5, this high-severity vulnerability poses a significant risk to organizational confidentiality and integrity, as attackers can leverage these requests to pivot deeper into the internal network.

Immediate Action: Upgrade WeKan to version 8.35.0 or later to apply the necessary protocol and destination validation checks.

Proactive Monitoring: Review web server and application access logs for unusual outbound requests originating from the WeKan server, particularly those targeting internal IP ranges.

Compensating Controls: Implement strict egress filtering on the host machine to prevent the WeKan service from initiating connections to sensitive internal network segments.

Public Exploit Available: Unknown

Organizations running WeKan should prioritize updating to version 8.35.0 immediately to remediate this SSRF vulnerability. Failure to patch allows authenticated users to bypass network access controls and manipulate application data, creating a significant security blind spot within the internal environment.