CVE-2026-1895

Published: Feb 4, 2026Modified: Feb 23, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to address this issue. This patch is called 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. It is recommended to upgrade the affected component.

Affected (1)

Products: Wekan Project: Wekan

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wekan Project Wekan	Before 8.21

Related CWEs

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (7)

https://github.com/wekan/wekan/

Source: cna@vuldb.com

Product

https://github.com/wekan/wekan/commit/8c0b4f79d8582932528ec2fdf2a4487c86770fb9

Source: cna@vuldb.com

Patch

https://github.com/wekan/wekan/releases/tag/v8.21

Source: cna@vuldb.com

ProductRelease Notes

https://vuldb.com/?ctiid.344267

Source: cna@vuldb.com

Permissions RequiredVDB Entry

https://vuldb.com/?id.344267

Source: cna@vuldb.com

Third Party AdvisoryVDB Entry

https://vuldb.com/?submit.742666

Source: cna@vuldb.com

Third Party AdvisoryVDB Entry

https://vuldb.com/?submit.742679

Source: cna@vuldb.com

Timeline

No history available yet.