What’s Vulnerable › Vulnerabilities

CVE-2026-1894: WeKan REST API checklistItems.js Checklist REST Bleed improper authorization

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-04 · updated 2026-06-17
• Weakness: CWE-266

Description

A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. The patch is named 251d49eea94834cf351bb395808f4a56fb4dbb44. Upgrading the affected component is recommended.

Affected products

• WeKan: before 8.21 — fixed in 8.21

How to fix

Upgrade to a fixed version: WeKan 8.21. Check the vendor advisory for mitigations.

References

• https://github.com/wekan/wekan/
• https://github.com/wekan/wekan/commit/251d49eea94834cf351bb395808f4a56fb4dbb44
• https://github.com/wekan/wekan/releases/tag/v8.21
• https://vuldb.com/?ctiid.344266
• https://vuldb.com/?id.344266
• https://vuldb.com/?submit.742663

Get alerted when CVE-2026-1894 or the next vulnerability affects your stack