CVE-2026-1892

Katalog CVE

CVSS 5.0 · Medium EPSS 0,27%

Kerentanan Incorrect Privilege Assignment pada wekan project wekan. Skor CVSS 3.1 5.0 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API. Such manipulation of the argument item.cardId/item.checklistId/card.boardId leads to improper authorization. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. Upgrading to version 8.21 mitigates this issue. The name of the patch is cabfeed9a68e21c469bf206d8655941444b9912c. It is suggested to upgrade the affected component.

Rincian

Terbit di NVD

4 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wekan/wekan/commit/cabfeed9a68e21c469bf206d8655941444b9912c patch
• https://vuldb.com/?id.344265 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.742662 advisory pihak ketiga · vdb entry
• https://github.com/wekan/wekan/ product
• https://github.com/wekan/wekan/releases/tag/v8.21 release notes
• https://vuldb.com/?ctiid.344265 permissions required · vdb entry