CVE-2026-1894

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-1894
A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. The patch is named 251d49eea94834cf351bb395808f4a56fb4dbb44. Upgrading the affected component is recommended.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/wekan/wekan/ Product
https://github.com/wekan/wekan/commit/251d49eea94834cf351bb395808f4a56fb4dbb44 Patch
https://github.com/wekan/wekan/releases/tag/v8.21 Product Release Notes
https://vuldb.com/?ctiid.344266 Permissions Required VDB Entry
https://vuldb.com/?id.344266 Third Party Advisory VDB Entry
https://vuldb.com/?submit.742663 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:16

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue detectada en WeKan hasta la versión 8.20. Esto afecta una función desconocida del archivo models/checklistItems.js del componente REST API. Realizar una manipulación del argumento item.cardId/item.checklistId/card.boardId resulta en una autorización incorrecta. La explotación remota del ataque es posible. Actualizar a la versión 8.21 solucionará este problema. El parche se denomina 251d49eea94834cf351bb395808f4a56fb4dbb44. Se recomienda actualizar el componente afectado.

11 Feb 2026, 19:08

Type Values Removed Values Added
References () https://github.com/wekan/wekan/ - () https://github.com/wekan/wekan/ - Product
References () https://github.com/wekan/wekan/commit/251d49eea94834cf351bb395808f4a56fb4dbb44 - () https://github.com/wekan/wekan/commit/251d49eea94834cf351bb395808f4a56fb4dbb44 - Patch
References () https://github.com/wekan/wekan/releases/tag/v8.21 - () https://github.com/wekan/wekan/releases/tag/v8.21 - Product, Release Notes
References () https://vuldb.com/?ctiid.344266 - () https://vuldb.com/?ctiid.344266 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.344266 - () https://vuldb.com/?id.344266 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.742663 - () https://vuldb.com/?submit.742663 - Third Party Advisory, VDB Entry
First Time Wekan Project wekan
Wekan Project
CPE cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*

04 Feb 2026, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-04 23:15

Updated : 2026-06-17 10:16

NVD link : CVE-2026-1894

Mitre link : CVE-2026-1894

CVE.ORG link : CVE-2026-1894

JSON object : View

Products Affected

wekan_project

  • wekan
CWE
CWE-266

Incorrect Privilege Assignment

CWE-285

Improper Authorization