CVE-2026-1895

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to address this issue. This patch is called 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. It is recommended to upgrade the affected component.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266 CWE-284

Affected software

Vendor	Product	Versions
n/a	WeKan	8.0; 8.1; 8.2; 8.3; 8.4; 8.5; 8.6; 8.7; 8.8; 8.9; 8.10; 8.11; 8.12; 8.13; 8.14; 8.15; 8.16; 8.17; 8.18; 8.19

References

https://github.com/wekan/wekan/Product
https://github.com/wekan/wekan/commit/8c0b4f79d8582932528ec2fdf2a4487c86770fb9Patch
https://github.com/wekan/wekan/releases/tag/v8.21Product, Release Notes
https://vuldb.com/?ctiid.344267Permissions Required, VDB Entry
https://vuldb.com/?id.344267Third Party Advisory, VDB Entry
https://vuldb.com/?submit.742666Third Party Advisory, VDB Entry
https://vuldb.com/?submit.742679

Timeline

Published: Feb 4, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-189508.8A flaw was found in odh-dashboard. An authenticated user of the dashboard can exploit a vulnerability related to how RoleBindings are create CVE-2026-189518.8A flaw was found in the Red Hat OpenShift AI (RHOAI) overlay for the training operator. The RHOAI overlay incorrectly aggregates `trainjobs`CVE-2026-189528.1Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated rem CVE-2026-189538.8Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 throug CVE-2026-189545.5Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated CVE-2026-189575.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal a CVE-2026-189587.3A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6d CVE-2026-189595.4A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the fil CVE-2026-18966.3A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file s CVE-2026-189605.4The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked use CVE-2026-189618.1The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authenticatio CVE-2026-189624.3The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they tar