CVE-2026-1896

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/comprehensiveBoardMigration.js of the component Migration Operation Handler. The manipulation of the argument boardId leads to improper access controls. The attack is possible to be carried out remotely. Upgrading to version 8.21 addresses this issue. The identifier of the patch is cc35dafef57ef6e44a514a523f9a8d891e74ad8f. Upgrading the affected component is advised.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Feb 5, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-189605.4The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked use CVE-2026-189618.1The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authenticatio CVE-2026-189624.3The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they tar CVE-2026-189639.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access manageme CVE-2026-189646.1The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is CVE-2026-189658.8PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network t CVE-2026-189678.1A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker usin CVE-2026-189684.3A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknow CVE-2026-189697.3A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function CVE-2026-18974.3A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHisto CVE-2026-189707.3A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown func CVE-2026-189729.6An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This