Medium
WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control
Type: advisorySources: OSV
A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to address this issue. This patch is called 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. It is recommended to upgrade the affected component.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-1895
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 15:41 UTC · Revision 1
Source evidence
WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control
core-osv · Original sourcePublished 4 Feb 2026, 23:02 UTC
A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to address this issue. This patch is called 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. It is recommended to upgrade the affected component.
osv:CVE-2026-1895
Complete source record
{
"id": "704f92d7c05b5f51cdb5e544cd35790503f5f466c6222d04b79890b5ef0b22e2",
"url": "https://osv.dev/vulnerability/CVE-2026-1895",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control",
"summary": "A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to address this issue. This patch is called 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. It is recommended to upgrade the affected component.",
"evidence": "osv:CVE-2026-1895",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-1895",
"aliases": [
"CVE-2026-1895"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wekan/wekan",
"type": "GIT",
"events": [
{
"introduced": "7f31d7c812a31eb8229d897558ae1657aa783fff"
},
{
"fixed": "8c0b4f79d8582932528ec2fdf2a4487c86770fb9"
},
{
"fixed": "603a65ef17969a2388c9175d5853197dfa48efe1"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "8.10"
},
{
"last_affected": "8.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.11"
},
{
"last_affected": "8.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.12"
},
{
"last_affected": "8.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.14"
},
{
"last_affected": "8.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.15"
},
{
"last_affected": "8.15"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.16"
},
{
"last_affected": "8.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.17"
},
{
"last_affected": "8.17"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.18"
},
{
"last_affected": "8.18"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.19"
},
{
"last_affected": "8.19"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.20"
},
{
"last_affected": "8.20"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"fixed": "8c0b4f79d8582932528ec2fdf2a4487c86770fb9"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "603a65ef17969a2388c9175d5853197dfa48efe1"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v8.21"
}
]
}
}
],
"versions": [
"8.10",
"8.11",
"8.12",
"8.14",
"8.15",
"8.16",
"8.17",
"8.18",
"8.19",
"8.20",
"v8.20",
"v8.19",
"v8.18",
"v8.17",
"v8.16",
"v8.15",
"v8.14",
"v8.12",
"v8.11",
"v8.10"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1895.json"
}
}
],
"modified": "2026-10-28T02:30:36.795324926Z",
"provider": "osv",
"references": [
"https://github.com/wekan/wekan/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1895.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-1895",
"https://vuldb.com/?id.344267",
"https://vuldb.com/?submit.742666",
"https://vuldb.com/?submit.742679",
"https://vuldb.com/?ctiid.344267",
"https://github.com/wekan/wekan/commit/8c0b4f79d8582932528ec2fdf2a4487c86770fb9",
"https://github.com/wekan/wekan/releases/tag/v8.21"
],
"provider_metadata": {
"cwe_ids": [
"CWE-266",
"CWE-284"
],
"cna_assigner": "VulDB",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "8.1"
},
{
"last_affected": "8.1"
},
{
"introduced": "8.2"
},
{
"last_affected": "8.2"
},
{
"introduced": "8.3"
},
{
"last_affected": "8.3"
},
{
"introduced": "8.4"
},
{
"last_affected": "8.4"
},
{
"introduced": "8.5"
},
{
"last_affected": "8.5"
},
{
"introduced": "8.6"
},
{
"last_affected": "8.6"
},
{
"introduced": "8.7"
},
{
"last_affected": "8.7"
},
{
"introduced": "8.8"
},
{
"last_affected": "8.8"
},
{
"introduced": "8.9"
},
{
"last_affected": "8.9"
},
{
"introduced": "8.13"
},
{
"last_affected": "8.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1895.json"
}
},
"related_cves": [
{
"value": "CVE-2026-1895",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504212,
"published_at": "2026-02-04T23:02:08.574+00:00"
}