CVE-2026-1895
Last modified
CVE-2026-1895 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to address this issue. This patch is called 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. It is recommended to upgrade the affected component.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wekan Project | Wekan | < 8.21 |
References
- https://github.com/wekan/wekan/releases/tag/v8.21Product, Release Notes
- https://vuldb.com/?ctiid.344267Permissions Required, VDB Entry
- https://vuldb.com/?id.344267Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.742666Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-1895?
How severe is CVE-2026-1895?
How do I fix CVE-2026-1895?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-18942A flaw was found in the Feast operator. A malicious tenant c…5.5
- CVE-2026-18943The WPC Admin Columns WordPress plugin before 2.3.4 does not…6.5
- CVE-2026-18946The Contact Form to Any API WordPress plugin before 3.0.7 do…7.5
- CVE-2026-18947A flaw was found in Feast. An authorization bypass vulnerabi…8.5
- CVE-2026-18948A flaw was found in Feast. The system improperly deserialize…9.9
- CVE-2026-18949A flaw was found in odh-dashboard. This vulnerability allows…8.8
- CVE-2026-18950A flaw was found in odh-dashboard. An authenticated user of …8.8
- CVE-2026-18951A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay…8.8
- CVE-2026-18953Improper limitation of a pathname to a restricted directory …8.8
- CVE-2026-18954Incorrect authorization in the aggregation pipeline tool in …5.7
- CVE-2026-18958A vulnerability was detected in imranrisal-dev Student-Manag…7.3
- CVE-2026-18959A flaw has been found in yushine InnoShop up to 0.8.2. Affec…5.4
Are you affected by CVE-2026-1895?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST