CVE-2026-1894

Katalog CVE

CVSS 5.4 · Medium EPSS 0,27%

Kerentanan Incorrect Privilege Assignment pada wekan project wekan. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. The patch is named 251d49eea94834cf351bb395808f4a56fb4dbb44. Upgrading the affected component is recommended.

Rincian

Terbit di NVD

4 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wekan/wekan/commit/251d49eea94834cf351bb395808f4a56fb4dbb44 patch
• https://vuldb.com/?id.344266 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.742663 advisory pihak ketiga · vdb entry
• https://github.com/wekan/wekan/ product
• https://github.com/wekan/wekan/releases/tag/v8.21 product · release notes
• https://vuldb.com/?ctiid.344266 permissions required · vdb entry