CVE-2026-1964: WeKan Auth Bypass Vulnerability

CVE-2026-1964 Overview

A vulnerability has been identified in WeKan versions up to 8.20 that involves improper access controls in the REST API endpoint. The vulnerability exists within the models/boards.js file and specifically affects the board title update functionality. Due to insufficient authorization checks, authenticated users can modify board titles without proper verification of write access to the target board.

Critical Impact

Authenticated attackers can remotely exploit this vulnerability to modify board titles on boards they should not have write access to, potentially leading to unauthorized data manipulation and integrity violations in collaborative project management workflows.

Affected Products

• WeKan versions up to 8.20
• WeKan REST API Endpoint (/api/boards/:boardId/title)
• models/boards.js component

Discovery Timeline

• 2026-02-05 - CVE-2026-1964 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-1964

Vulnerability Analysis

This vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), affecting the WeKan kanban board application's REST API. The flaw stems from an authentication check that only verified whether a user was logged in, rather than confirming the user had appropriate write permissions for the specific board being modified.

The vulnerable endpoint PUT /api/boards/:boardId/title allowed any authenticated user to update the title of any board in the system, regardless of their actual membership or role on that board. This represents a classic broken access control pattern where authentication is confused with authorization.

Remote exploitation is possible for any user with valid credentials to the WeKan instance. The attack requires only network access to the REST API and a valid user session.

Root Cause

The root cause of this vulnerability is the improper implementation of access control checks in the board title update endpoint. The original code used Authentication.checkUserId(req.userId) which only validates that a user is authenticated, but fails to verify whether that authenticated user has write permissions on the target board specified by boardId.

Attack Vector

The attack vector is network-based and requires low privileges (an authenticated user account). An attacker with a valid user session can send a crafted PUT request to the /api/boards/:boardId/title endpoint with an arbitrary board ID to modify board titles they should not have access to. This could be used to:

1. Deface boards visible to other users
2. Disrupt project workflows by renaming boards
3. Potentially combine with social engineering attacks by changing board names to misleading titles

   */
   JsonRoutes.add('PUT', '/api/boards/:boardId/title', function(req, res) {
     try {
-      Authentication.checkUserId(req.userId);
       const boardId = req.params.boardId;
+      Authentication.checkBoardWriteAccess(req.userId, boardId);
       const title = req.body.title;

       Boards.direct.update({ _id: boardId }, { $set: { title } });

Source: GitHub Commit Details

Detection Methods for CVE-2026-1964

Indicators of Compromise

• Unexpected board title changes in WeKan audit logs
• PUT requests to /api/boards/:boardId/title from users who are not board members
• Anomalous patterns of board title modifications across multiple boards by a single user
• Access log entries showing successful board title updates for boards outside user's assigned projects

Detection Strategies

• Monitor WeKan application logs for PUT requests to the board title endpoint and cross-reference with board membership data
• Implement alerting on board title changes where the requesting user is not listed as a board member or administrator
• Review access patterns for the REST API endpoint /api/boards/:boardId/title for unauthorized access attempts

Monitoring Recommendations

• Enable verbose logging for WeKan REST API endpoints, particularly authentication and authorization events
• Implement real-time monitoring of board modification activities with user context
• Create baseline metrics for normal board title update frequency per user to detect anomalous behavior

How to Mitigate CVE-2026-1964

Immediate Actions Required

• Upgrade WeKan to version 8.21 or later immediately
• Review recent board title changes for unauthorized modifications
• Audit user access patterns to identify potential exploitation
• Consider temporarily restricting API access if immediate patching is not possible

Patch Information

The vulnerability is fixed in WeKan version 8.21. The security patch (commit 545566f5663545d16174e0f2399f231aa693ab6e) replaces the insufficient Authentication.checkUserId() call with Authentication.checkBoardWriteAccess() which properly validates that the requesting user has write permissions for the specific board being modified.

Upgrade resources:

• GitHub Release Tag v8.21
• GitHub Commit Details

Workarounds

• Restrict network access to the WeKan REST API using firewall rules or reverse proxy configuration until patching is complete
• Implement additional authentication middleware or WAF rules to validate board access before requests reach the application
• Disable the REST API entirely if not required for operations until the upgrade can be performed

# Configuration example
# Restrict access to WeKan API endpoints via nginx
location /api/boards/ {
    # Allow only trusted internal networks
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    proxy_pass http://wekan_backend;
}