CVE-2026-1894: WeKan REST API Auth Bypass Vulnerability

CVE-2026-1894 Overview

A vulnerability was detected in WeKan up to version 8.20. This impacts the file models/checklistItems.js of the component REST API. Performing a manipulation of the arguments item.cardId, item.checklistId, or card.boardId results in improper authorization. Remote exploitation of this attack is possible. Upgrading to version 8.21 fixes this issue.

Critical Impact

This improper authorization vulnerability allows authenticated attackers to bypass access controls via the REST API, potentially accessing or modifying checklist items across boards they should not have permission to access.

Affected Products

• WeKan versions up to and including 8.20
• WeKan REST API component (models/checklistItems.js)
• Self-hosted WeKan deployments using affected versions

Discovery Timeline

• 2026-02-04 - CVE-2026-1894 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-1894

Vulnerability Analysis

This vulnerability represents a classic Broken Access Control (CWE-266: Incorrect Privilege Assignment) issue within WeKan's REST API. The affected component, models/checklistItems.js, fails to properly validate whether the requesting user has appropriate permissions before allowing operations on checklist items.

The vulnerability allows authenticated users to manipulate API parameters including item.cardId, item.checklistId, and card.boardId to access or modify resources outside their authorized scope. This can lead to unauthorized data access across different boards and projects within a WeKan installation.

Root Cause

The root cause stems from insufficient authorization checks in the checklist items model. When processing API requests, the application fails to verify that the user making the request has the necessary permissions on the target board, card, or checklist before executing the requested operation. This allows attackers to reference arbitrary resource identifiers and bypass intended access restrictions.

Attack Vector

The attack is conducted remotely over the network through the WeKan REST API. An authenticated attacker can craft malicious API requests by manipulating the item.cardId, item.checklistId, or card.boardId parameters to reference resources they should not have access to.

The attack flow typically involves:

1. An authenticated user identifies valid resource identifiers (card IDs, checklist IDs, or board IDs) belonging to other users or restricted boards
2. The attacker crafts API requests to the checklist items endpoint with these unauthorized resource identifiers
3. Due to missing authorization checks, the API processes these requests and returns or modifies data the attacker should not have access to

For technical details on the vulnerability and the fix, see the security patch commit.

Detection Methods for CVE-2026-1894

Indicators of Compromise

• Unusual API requests to checklist item endpoints with cross-board resource references
• API access logs showing users querying or modifying checklist items on boards they are not members of
• Unexpected data access patterns involving item.cardId, item.checklistId, or card.boardId parameters
• Authentication logs showing normal user accounts accessing multiple unrelated board resources

Detection Strategies

• Monitor REST API logs for requests to checklist item endpoints with parameter manipulation patterns
• Implement anomaly detection for users accessing resources across multiple boards in rapid succession
• Review API access logs for authorization bypass attempts targeting models/checklistItems.js
• Deploy application-level monitoring to detect cross-board resource access attempts

Monitoring Recommendations

• Enable detailed logging for all REST API endpoints in WeKan
• Set up alerts for API requests that return authorization errors or access denied responses
• Monitor for elevated request volumes to checklist-related API endpoints
• Implement user behavior analytics to detect unusual access patterns across board boundaries

How to Mitigate CVE-2026-1894

Immediate Actions Required

• Upgrade WeKan installations to version 8.21 or later immediately
• Review API access logs for any signs of exploitation prior to patching
• Audit user permissions and board memberships to ensure proper access control
• Consider temporarily restricting API access until the patch is applied if immediate upgrade is not possible

Patch Information

The vulnerability is fixed in WeKan version 8.21. The patch is identified by commit hash 251d49eea94834cf351bb395808f4a56fb4dbb44. Organizations should upgrade to the patched version as soon as possible.

Patch resources:

• WeKan Release v8.21
• Security Patch Commit
• WeKan GitHub Repository

Workarounds

• Implement network-level restrictions to limit API access to trusted IP ranges
• Use a reverse proxy or web application firewall (WAF) to filter and validate API requests
• Temporarily disable external API access if the upgrade cannot be performed immediately
• Review and restrict user accounts to minimum necessary permissions

# Example: Restrict API access via nginx reverse proxy
# Add to your nginx configuration for WeKan
location /api/ {
    # Allow only trusted IP ranges
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Additional rate limiting
    limit_req zone=api_limit burst=10 nodelay;
    
    proxy_pass http://wekan_backend;
}