CVE-2026-1892CWE-266CWE-285

WeKan REST API boards.js setBoardOrgs improper authorization

Low · published February 4, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
18.5
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API. Such manipulation of the argument item.cardId/item.checklistId/card.boardId leads to improper authorization. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is reported as difficult. Upgrading to version 8.21 mitigates this issue. The name of the patch is cabfeed9a68e21c469bf206d8655941444b9912c. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00272 · 18.5th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-285 · Improper Authorization
Published
2026-02-04T22:02Z
EPSS history
Timeline
  • 04 FEB 22:02Z
    WeKan REST API boards.js setBoardOrgs improper authorization
    cvelistv5