Vulnerability · Published Feb 5, 2026 · Assigned by VulDB

CVE-2026-1964WeKan REST Endpoint boards.js BoardTitleRESTBleed access control

Medium 4.3

In plain English

A medium-severity improper access control in WeKan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 82.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. Patch name: 545566f5663545d16174e0f2399f231aa693ab6e. It is advisable to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
n/a	WeKan	8.08.18.28.38.48.58.68.7

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

References

VDB-344486 | WeKan REST Endpoint boards.js BoardTitleRESTBleed access control vdb-entry, technical-description
VDB-344486 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #742680 | Wekan <8.21 Improper access control in REST endpoint (CWE-284) third-party-advisory
https://github.com/wekan/wekan/commit/545566f5663545d16174e0f2399f231aa693ab6e patch
https://github.com/wekan/wekan/releases/tag/v8.21 patch
https://github.com/wekan/wekan/ product