CVE-2026-1894
📋 TL;DR
This vulnerability in WeKan allows attackers to bypass authorization checks in the REST API by manipulating card/board ID parameters. Remote attackers can potentially access or modify data they shouldn't have permission to view. All WeKan instances up to version 8.20 are affected.
💻 Affected Systems
- WeKan
📦 What is this software?
Wekan by Wekan Project
⚠️ Risk & Real-World Impact
Worst Case
Complete data compromise where attackers can read, modify, or delete any cards, checklists, or board data in the system
Likely Case
Unauthorized access to sensitive board data, potentially exposing confidential information or allowing data manipulation
If Mitigated
Limited impact with proper network segmentation and access controls, but still potential for data exposure
🎯 Exploit Status
Requires some authentication but authorization bypass allows escalation. The patch commit shows specific parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.21
Vendor Advisory: https://github.com/wekan/wekan/releases/tag/v8.21
Restart Required: Yes
Instructions:
1. Backup your WeKan data and configuration
2. Stop the WeKan service
3. Update to WeKan version 8.21 or later
4. Restart the WeKan service
5. Verify the update was successful
🔧 Temporary Workarounds
Restrict API Access
allLimit access to the WeKan REST API endpoints using network controls or web application firewall rules
Disable Unnecessary API Endpoints
allTemporarily disable or restrict the affected REST API endpoints if not required for operations
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WeKan instances from untrusted networks
- Enhance monitoring of API access patterns and implement anomaly detection for unusual parameter manipulation
🔍 How to Verify
Check if Vulnerable:
Check WeKan version. If version is 8.20 or earlier, the system is vulnerableCheck Version:
Check WeKan web interface settings or run appropriate version check command for your deployment methodVerify Fix Applied:
Verify version is 8.21 or later and check that the patch commit 251d49eea94834cf351bb395808f4a56fb4dbb44 is present📡 Detection & Monitoring
Log Indicators:
- Unusual API requests to checklistItems endpoints with manipulated ID parameters
- Failed authorization attempts followed by successful requests with similar parameters
- Access patterns showing users accessing boards/cards they shouldn't have permissions for
Network Indicators:
- Unusual REST API traffic patterns, particularly to models/checklistItems endpoints
- Multiple requests with varying cardId/checklistId/boardId parameters from single sources
SIEM Query:
source="wekan" AND (uri_path="/api/boards/*/cards/*/checklists/*/items" OR uri_path CONTAINS "checklistItems") AND (http_status=200 OR http_status=201) AND user_id NOT IN authorized_users_for_resource