WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform admini…

WeKan versions before 8.35 contain a missing authorization vulnerability in Integration REST API endpoints. The vulnerability allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can exploit insufficient authorization checks in JsonRoutes REST handlers to enumerate integrations including webhook URLs, create new integrations, modify or delete existing integrations, and manage integration activities. This represents a privilege escalation vulnerability where lower-privileged users can perform administrative functions.