Medium
WeKan REST API checklistItems.js Checklist REST Bleed improper authorization
Type: advisorySources: OSV
A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. The patch is named 251d49eea94834cf351bb395808f4a56fb4dbb44. Upgrading the affected component is recommended.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-1894
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 23:38 UTC · Revision 1
Source evidence
WeKan REST API checklistItems.js Checklist REST Bleed improper authorization
core-osv · Original sourcePublished 4 Feb 2026, 22:32 UTC
A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. The patch is named 251d49eea94834cf351bb395808f4a56fb4dbb44. Upgrading the affected component is recommended.
osv:CVE-2026-1894
Complete source record
{
"id": "77c7f2509deb3a3c8eee95b5238fc6cdc7f54b85ae7f5df420f53699ee2f373a",
"url": "https://osv.dev/vulnerability/CVE-2026-1894",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "WeKan REST API checklistItems.js Checklist REST Bleed improper authorization",
"summary": "A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a manipulation of the argument item.cardId/item.checklistId/card.boardId results in improper authorization. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. The patch is named 251d49eea94834cf351bb395808f4a56fb4dbb44. Upgrading the affected component is recommended.",
"evidence": "osv:CVE-2026-1894",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-1894",
"aliases": [
"CVE-2026-1894"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wekan/wekan",
"type": "GIT",
"events": [
{
"introduced": "7f31d7c812a31eb8229d897558ae1657aa783fff"
},
{
"fixed": "251d49eea94834cf351bb395808f4a56fb4dbb44"
},
{
"fixed": "603a65ef17969a2388c9175d5853197dfa48efe1"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "8.10"
},
{
"last_affected": "8.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.11"
},
{
"last_affected": "8.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.12"
},
{
"last_affected": "8.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.14"
},
{
"last_affected": "8.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.15"
},
{
"last_affected": "8.15"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.16"
},
{
"last_affected": "8.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.17"
},
{
"last_affected": "8.17"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.18"
},
{
"last_affected": "8.18"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.19"
},
{
"last_affected": "8.19"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "8.20"
},
{
"last_affected": "8.20"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"fixed": "251d49eea94834cf351bb395808f4a56fb4dbb44"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "603a65ef17969a2388c9175d5853197dfa48efe1"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v8.21"
}
]
}
}
],
"versions": [
"8.10",
"8.11",
"8.12",
"8.14",
"8.15",
"8.16",
"8.17",
"8.18",
"8.19",
"8.20",
"v8.20",
"v8.19",
"v8.18",
"v8.17",
"v8.16",
"v8.15",
"v8.14",
"v8.12",
"v8.11",
"v8.10"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1894.json"
}
}
],
"modified": "2026-10-28T02:30:40.331140689Z",
"provider": "osv",
"references": [
"https://github.com/wekan/wekan/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1894.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-1894",
"https://vuldb.com/?id.344266",
"https://vuldb.com/?submit.742663",
"https://vuldb.com/?ctiid.344266",
"https://github.com/wekan/wekan/commit/251d49eea94834cf351bb395808f4a56fb4dbb44",
"https://github.com/wekan/wekan/releases/tag/v8.21"
],
"provider_metadata": {
"cwe_ids": [
"CWE-266",
"CWE-285"
],
"cna_assigner": "VulDB",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "8.1"
},
{
"last_affected": "8.1"
},
{
"introduced": "8.2"
},
{
"last_affected": "8.2"
},
{
"introduced": "8.3"
},
{
"last_affected": "8.3"
},
{
"introduced": "8.4"
},
{
"last_affected": "8.4"
},
{
"introduced": "8.5"
},
{
"last_affected": "8.5"
},
{
"introduced": "8.6"
},
{
"last_affected": "8.6"
},
{
"introduced": "8.7"
},
{
"last_affected": "8.7"
},
{
"introduced": "8.8"
},
{
"last_affected": "8.8"
},
{
"introduced": "8.9"
},
{
"last_affected": "8.9"
},
{
"introduced": "8.13"
},
{
"last_affected": "8.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1894.json"
}
},
"related_cves": [
{
"value": "CVE-2026-1894",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508059,
"published_at": "2026-02-04T22:32:08.834+00:00"
}