CVE-2026-1892
A security vulnerability has been detected in WeKan up to 8.20.
Does this matter?
Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.
Description
A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API. Such manipulation of the argument item.cardId/item.checklistId/card.boardId leads to improper authorization. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. Upgrading to version 8.21 mitigates this issue. The name of the patch is cabfeed9a68e21c469bf206d8655941444b9912c. It is suggested to upgrade the affected component.
- CVSS 4.0
- 2.3 LOWCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.25% probability · 17th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-266, CWE-285
- Affected
- wekan project/wekan
- Source
- cna@vuldb.com
References
- https://github.com/wekan/wekan/Product
- https://github.com/wekan/wekan/commit/cabfeed9a68e21c469bf206d8655941444b9912cPatch
- https://github.com/wekan/wekan/releases/tag/v8.21Release Notes
- https://vuldb.com/?ctiid.344265Permissions Required, VDB Entry
- https://vuldb.com/?id.344265Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.742662Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.