CVE-2026-1964

A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. Patch name: 545566f5663545d16174e0f2399f231aa693ab6e. It is advisable to upgrade the affected component.

• CWE-266
• CWE-284

• https://github.com/wekan/wekan/Product
• https://github.com/wekan/wekan/commit/545566f5663545d16174e0f2399f231aa693ab6ePatch
• https://github.com/wekan/wekan/releases/tag/v8.21Product, Release Notes
• https://vuldb.com/?ctiid.344486Permissions Required, VDB Entry
• https://vuldb.com/?id.344486Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.742680Third Party Advisory, VDB Entry

Published

Feb 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19632The TranslatePress – Translate Multilingual sites with AI Tr…9.8
• CVE-2026-19633PostgreSQL Anonymizer contains a vulnerability that allows u…8.8
• CVE-2026-19634PostgreSQL Anonymizer contains a SQL injection vulnerability…6.4
• CVE-2026-19635A local privilege escalation vulnerability exists in Securit…8.8
• CVE-2026-19636An issue was identified in which CSRF tokens were generated …5.3
• CVE-2026-19639An improper access control vulnerability exists where an aut…4.3
• CVE-2026-19640On affected platforms running Arista EOS, an authenticated u…4.2
• CVE-2026-19641On affected platforms running Arista EOS with password authe…5.3
• CVE-2026-19642An out-of-bounds write issue in the Base64 decoder in Amazon…5.9
• CVE-2026-19643An out-of-bounds read issue in the Base64 decoder in Amazon …5.3
• CVE-2026-19644Adobe Experience Manager is affected by a DOM-based Cross-Si…5.4
• CVE-2026-19645IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authentic…6.5