CVE-2026-1894 - Vulnerability Details

- WeKan REST API checklistItems.js Checklist REST Bleed improper authorization

Description

A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. The patch is named 251d49eea94834cf351bb395808f4a56fb4dbb44. Upgrading the affected component is recommended.

Published: 2026-02-04

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in WeKan's REST API, specifically within models/checklistItems.js, allows an attacker to manipulate the parameters item.cardId, item.checklistId, and card.boardId. This improper authorization check lets unauthenticated or insufficiently privileged users access or alter checklist items beyond their intended scope. The vulnerability triggers when the API processes the crafted request, resulting in potential data leakage or unauthorized modifications.

Affected Systems

The issue affects all WeKan installations running versions up to 8.20. The affected component is the REST API endpoint for checklist items. Version 8.21 and later contain a patch (commit 251d49eea94834cf351bb395808f4a56fb4dbb44) that resolves the authorization bypass.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate potential impact. EPSS is below 1%, suggesting a low likelihood of current exploitation, yet the vulnerability is remotely exploitable via the public API. The lack of authentication checks implies that an attacker could craft API requests from any host if the server exposes the endpoint. The vulnerability is not listed in KEV, but administrators should still prioritize patching to avoid possible data exposure.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

WeKan

affected

Version	Status	Constraints
`8.0`	affected	—
`8.1`	affected	—
`8.2`	affected	—
`8.3`	affected	—
`8.4`	affected	—
`8.5`	affected	—
`8.6`	affected	—
`8.7`	affected	—
`8.8`	affected	—
`8.9`	affected	—
`8.10`	affected	—
`8.11`	affected	—
`8.12`	affected	—
`8.13`	affected	—
`8.14`	affected	—
`8.15`	affected	—
`8.16`	affected	—
`8.17`	affected	—
`8.18`	affected	—
`8.19`	affected	—
`8.20`	affected	—
`8.21`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*

No data.

Vendor	Product	Confidence	Versions
Wekan Project	Wekan	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade WeKan to version 8.21 or later to apply the patch identified by commit 251d49eea94834cf351bb395808f4a56fb4dbb44.
Test the checklistItems endpoint with manipulated parameters to ensure the authorization checks now enforce proper access control.
Restrict external access to the WeKan REST API or deploy network controls to block unauthorized requests to the /checklistItems endpoints until the patch is in place.

Generated by OpenCVE AI on April 17, 2026 at 23:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/wekan/wekan/
https://github.com/wekan/wekan/commit/251d49eea94834cf351bb395808f4a56fb4dbb44
https://github.com/wekan/wekan/releases/tag/v8.21
https://vuldb.com/?ctiid.344266
https://vuldb.com/?id.344266
https://vuldb.com/?submit.742663

History

Wed, 11 Feb 2026 19:15:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:wekan_project:wekan::::::::

Thu, 05 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 05 Feb 2026 11:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wekan Project Wekan Project wekan
Vendors & Products		Wekan Project Wekan Project wekan

Wed, 04 Feb 2026 22:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. The patch is named 251d49eea94834cf351bb395808f4a56fb4dbb44. Upgrading the affected component is recommended.
Title		WeKan REST API checklistItems.js Checklist REST Bleed improper authorization
Weaknesses		CWE-266 CWE-285
References		https://github.com/wekan/wekan/ https://github.com/wekan/wekan/commit/251d49eea94834cf351bb395808f4a56fb4dbb44 https://github.com/wekan/wekan/releases/tag/v8.21 https://vuldb.com/?ctiid.344266 https://vuldb.com/?id.344266 https://vuldb.com/?submit.742663
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}`

Subscriptions

Wekan Project Wekan

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-02-04T22:32:08.834Z

Updated: 2026-02-23T09:17:07.401Z

Reserved: 2026-02-04T14:46:17.536Z

Link: CVE-2026-1894

Vulnrichment

Updated: 2026-02-05T15:14:52.179Z

NVD

Status : Analyzed

Published: 2026-02-04T23:15:55.657

Modified: 2026-02-11T19:08:27.980

Link: CVE-2026-1894

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-17T23:15:30Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object