CVE-2026-1892 LOW

CVE-2026-1892: WeKan REST API boards.js setBoardOrgs improper authorization

Vendor N/A
Product WeKan
Weakness CWE-285
Published February 4, 2026
Last update February 23, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

What the vulnerability does

01Description

A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API. Such manipulation of the argument item.cardId/item.checklistId/card.boardId leads to improper authorization. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. Upgrading to version 8.21 mitigates this issue. The name of the patch is cabfeed9a68e21c469bf206d8655941444b9912c. It is suggested to upgrade the affected component.

Key dates

02Disclosure timeline

February 4, 2026 CVE published
February 23, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-1361 IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function CVE-2023-32709 Low-privileged User can View Hashed Default Splunk Password CVE-2025-9760 Portabilis i-Educar Matricula API matricula improper authorization CVE-2025-10822 fuyang_lipengjun platform queryAll SysSmsLogController improper authorization CVE-2021-44204 Local privilege escalation via named pipe due to improper access control checks