CVE-2026-1892

A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API. Such manipulation of the argument item.cardId/item.checklistId/card.boardId leads to improper authorization. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. Upgrading to version 8.21 mitigates this issue. The name of the patch is cabfeed9a68e21c469bf206d8655941444b9912c. It is suggested to upgrade the affected component.

• CWE-266
• CWE-285

• https://github.com/wekan/wekan/Product
• https://github.com/wekan/wekan/commit/cabfeed9a68e21c469bf206d8655941444b9912cPatch
• https://github.com/wekan/wekan/releases/tag/v8.21Release Notes
• https://vuldb.com/?ctiid.344265Permissions Required, VDB Entry
• https://vuldb.com/?id.344265Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.742662Third Party Advisory, VDB Entry

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18902A vulnerability was detected in H3C NX15 V100R017. Affected …7.3
• CVE-2026-18903A vulnerability was determined in yeqifu warehouse up to aaf…4.3
• CVE-2026-18907Path Traversal in Download File Feature in com.talpa.hibrows…7.5
• CVE-2026-18909A stack-based buffer overflow vulnerability exists in ELAN M…5.6
• CVE-2026-1891The Simple Football Scoreboard plugin for WordPress is vulne…6.4
• CVE-2026-18915Invocation of process using visible sensitive information vu…5
• CVE-2026-18927A vulnerability was determined in imranrisal-dev Student-Man…6.3
• CVE-2026-1893The Orbisius Random Name Generator plugin for WordPress is v…6.4
• CVE-2026-18933The wp-downloadmanager WordPress plugin, in version 1.68.11 …7.2
• CVE-2026-18934The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 …5.5
• CVE-2026-18938A flaw was found in p11-kit. A local attacker, or one with e…6.2
• CVE-2026-1894A vulnerability was detected in WeKan up to 8.20. This impac…5.4