CVE-2026-1896
Last modified
CVE-2026-1896 is a medium-severity vulnerability rated 6.3/10 on the CVSS scale. A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/comprehensiveBoardMigration.js of the component Migration Operation Handler. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/comprehensiveBoardMigration.js of the component Migration Operation Handler. The manipulation of the argument boardId leads to improper access controls. The attack is possible to be carried out remotely. Upgrading to version 8.21 addresses this issue. The identifier of the patch is cc35dafef57ef6e44a514a523f9a8d891e74ad8f. Upgrading the affected component is advised.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wekan Project | Wekan | < 8.21 |
References
- https://github.com/wekan/wekan/releases/tag/v8.21Release Notes
- https://vuldb.com/?ctiid.344268Permissions Required, VDB Entry
- https://vuldb.com/?id.344268Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.742670Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-1896?
How severe is CVE-2026-1896?
How do I fix CVE-2026-1896?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-18950A flaw was found in odh-dashboard. An authenticated user of …8.8
- CVE-2026-18951A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay…8.8
- CVE-2026-18953Improper limitation of a pathname to a restricted directory …8.8
- CVE-2026-18954Incorrect authorization in the aggregation pipeline tool in …5.7
- CVE-2026-18958A vulnerability was detected in imranrisal-dev Student-Manag…7.3
- CVE-2026-18959A flaw has been found in yushine InnoShop up to 0.8.2. Affec…5.4
- CVE-2026-18960The Block User Account WordPress plugin before 2.0.1 does no…5.4
- CVE-2026-18961The Social Login, Passkeys, Magic Link & Email OTP – Passwor…8.1
- CVE-2026-18962The WP Photo Album Plus WordPress plugin before 9.2.09.002 d…4.3
- CVE-2026-18967A flaw was found in the SAML broker component of Keycloak, a…8.1
- CVE-2026-18968A security vulnerability has been detected in ttttonyhe OBlo…4.3
- CVE-2026-18969A vulnerability was detected in Rongzhitong Visual Integrate…7.3
Are you affected by CVE-2026-1896?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST