CVE-2026-1895: WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control
A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to address this issue. This patch is called 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. It is recommended to upgrade the affected component.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1895?
CVE-2026-1895 has a high severity rating due to improper access controls affecting the Attachment Storage Handler in WeKan.
How do I fix CVE-2026-1895?
To fix CVE-2026-1895, upgrade WeKan to version 8.21 or higher to mitigate the vulnerability.
What versions of WeKan are affected by CVE-2026-1895?
CVE-2026-1895 affects all WeKan versions up to and including 8.20.
What component is impacted by CVE-2026-1895?
CVE-2026-1895 impacts the Attachment Storage Handler in the models/lists.js file of WeKan.
What are the potential consequences of CVE-2026-1895?
Exploitation of CVE-2026-1895 can lead to unauthorized access to sensitive data managed by WeKan.