CVE-2026-1895: WeKan Auth Bypass Vulnerability

CVE-2026-1895 Overview

A vulnerability has been identified in WeKan, an open-source kanban board application, affecting versions up to 8.20. The flaw exists within the applyWipLimit function in the models/lists.js file of the Attachment Storage Handler component. This improper access control vulnerability can be exploited remotely by authenticated attackers to bypass security restrictions and potentially access or modify data without proper authorization.

Critical Impact
Attackers with low privileges can remotely exploit improper access controls in WeKan's Attachment Storage Handler, potentially leading to unauthorized data access or modification across kanban boards.

Affected Products

WeKan versions up to and including 8.20
WeKan Attachment Storage Handler component
WeKan models/lists.js module

Discovery Timeline

2026-02-04 - CVE-2026-1895 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-1895

Vulnerability Analysis

This vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), indicating that the application fails to properly enforce access control policies. The vulnerable applyWipLimit function in the Attachment Storage Handler does not adequately verify whether the requesting user has the appropriate permissions before executing operations on list objects.

The flaw allows remote attackers with valid user credentials to manipulate WIP (Work In Progress) limits and potentially access attachment storage functionality beyond their intended authorization level. Since WeKan is commonly deployed for project management in organizational settings, successful exploitation could lead to unauthorized visibility into sensitive project data or the ability to modify workflow constraints.

Root Cause

The root cause lies in insufficient privilege validation within the applyWipLimit function located in models/lists.js. The function fails to properly verify that the authenticated user has the necessary permissions to modify WIP limits or access attachment storage for a given list or board. This allows users with lower privilege levels to perform actions that should be restricted to board administrators or owners.

Attack Vector

The vulnerability can be exploited remotely over the network. An attacker requires low-level authentication (a valid WeKan user account) but does not need any user interaction to execute the attack. The exploitation involves:

Authenticating to the WeKan application with any valid user account
Crafting malicious requests targeting the applyWipLimit function
Manipulating list operations or accessing attachment storage without proper authorization verification

The attack allows for limited impact on confidentiality, integrity, and availability of the affected WeKan instance, as the attacker can potentially read, modify, or disrupt data they should not have access to.

Detection Methods for CVE-2026-1895

Indicators of Compromise

Unusual API requests targeting list manipulation endpoints from users without board administration privileges
Unexpected modifications to WIP limits on boards where the modifying user lacks proper permissions
Anomalous access patterns to attachment storage from low-privileged user accounts
Log entries showing successful list operations from users not assigned to the respective boards

Detection Strategies

Monitor WeKan application logs for unauthorized access attempts to the applyWipLimit function
Implement alerts for WIP limit modifications by non-administrative users
Review audit trails for attachment storage access patterns that deviate from normal user behavior
Deploy web application firewall rules to detect and block suspicious request patterns targeting list manipulation endpoints

Monitoring Recommendations

Enable verbose logging for the models/lists.js module to capture detailed access control events
Set up automated alerts for permission-related errors and authorization failures
Regularly audit user access patterns against their assigned board permissions
Monitor for rapid successive requests to list-related API endpoints that may indicate exploitation attempts

How to Mitigate CVE-2026-1895

Immediate Actions Required

Upgrade WeKan to version 8.21 or later immediately
Review and audit user permissions across all boards to ensure principle of least privilege
Examine application logs for any signs of prior exploitation
Consider temporarily restricting WIP limit modification capabilities to administrators only until patching is complete

Patch Information

The vulnerability has been addressed in WeKan version 8.21. The fix is contained in commit 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. Organizations should upgrade to version 8.21 or later to remediate this vulnerability.

For more information, see:

Workarounds

Restrict network access to the WeKan application to trusted users and networks only
Implement additional authentication layers such as VPN or reverse proxy authentication
Review and tighten board-level permissions to minimize the impact of potential unauthorized access
Consider deploying a web application firewall (WAF) with rules to detect and block exploitation attempts

bash

# Upgrade WeKan to the patched version
# Using Docker (recommended deployment method):
docker pull wekanteam/wekan:v8.21
docker stop wekan
docker rm wekan
docker run -d --name wekan wekanteam/wekan:v8.21

# Verify the installed version
docker exec wekan cat /app/package.json | grep version