CVE-2026-1892

low-risk

Published 2026-02-04

A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API. Such manipulation of the argument item.cardId/item.checklistId/card.boardId leads to improper authorization. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. Upgrading to version 8.21 mitigates this issue. The name of the patch is cabfeed9a68e21c469bf206d8655941444b9912c. It is suggested to upgrade the affected component.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.0/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Wekan

Affected Vendors

Wekan Project

References (6)

Product https://github.com/wekan/wekan/

Patch https://github.com/wekan/wekan/commit/cabfeed9a68e21c469bf206d8655941444b9912c

Release Notes https://github.com/wekan/wekan/releases/tag/v8.21

Permissions Required https://vuldb.com/?ctiid.344265

Third Party Advisory https://vuldb.com/?id.344265

Third Party Advisory https://vuldb.com/?submit.742662

/ 100

low-risk

Severity 16/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal