5.3
Medium
CVE-2026-1894 A vulnerability was detected in WeKan up to 8.20
Description
A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. The patch is named 251d49eea94834cf351bb395808f4a56fb4dbb44. Upgrading the affected component is recommended.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WeKan 8.21 | earliest → < 8.21 | 8.21 |
| WeKan | 8.20 | No fix stated |
| WeKan | 8.19 | No fix stated |
| WeKan | 8.18 | No fix stated |
| WeKan | 8.17 | No fix stated |
| WeKan | 8.16 | No fix stated |
| WeKan | 8.15 | No fix stated |
| WeKan | 8.14 | No fix stated |
| WeKan | 8.13 | No fix stated |
Show the 13 other branches Hide the 13 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| WeKan | 8.12 | No fix stated |
| WeKan | 8.11 | No fix stated |
| WeKan | 8.10 | No fix stated |
| WeKan | 8.9 | No fix stated |
| WeKan | 8.8 | No fix stated |
| WeKan | 8.7 | No fix stated |
| WeKan | 8.6 | No fix stated |
| WeKan | 8.5 | No fix stated |
| WeKan | 8.4 | No fix stated |
| WeKan | 8.3 | No fix stated |
| WeKan | 8.2 | No fix stated |
| WeKan | 8.1 | No fix stated |
| WeKan | 8.0 | No fix stated |
References
- VDB-344266 | WeKan REST API checklistItems.js Checklist REST Bleed improper authorization vuldb.com
- VDB-344266 | CTI Indicators (IOB, IOC, TTP, IOA) vuldb.com
- Submit #742663 | Wekan <8.21 IDOR via REST API / improper object relationship validation vuldb.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of WeKan
The 14 CVEs of WeKan →
CVE-2026-2209
A vulnerability was detected in WeKan up to 8.18
5.3
Medium
CVE-2026-2208
A security vulnerability has been detected in WeKan up to 8.20
5.3
Medium
CVE-2026-2207
A weakness has been identified in WeKan up to 8.20
6.9
Medium
CVE-2026-2206
A security flaw has been discovered in WeKan up to 8.20
5.3
Medium