CVE-2026-1895 in WeKan (ListWIPBleed)
Summary
by MITRE • 02/05/2026
A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to address this issue. This patch is called 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. It is recommended to upgrade the affected component.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/12/2026
The vulnerability identified as CVE-2026-1895 affects WeKan version 8.20 and earlier, specifically targeting the Attachment Storage Handler component within the models/lists.js file. This flaw resides in the applyWipLimit function which governs how work-in-progress limits are enforced within the application's list management system. The issue represents a critical access control weakness that allows attackers to manipulate the system's permission model through remote execution. The vulnerability stems from insufficient input validation and authorization checks within the attachment storage handling mechanism, creating a pathway for unauthorized users to bypass normal access controls and potentially gain elevated privileges or access to restricted resources.
The technical implementation of this vulnerability involves the improper handling of user inputs within the applyWipLimit function, which processes attachment-related operations in the lists model. When an attacker successfully manipulates the parameters passed to this function, they can exploit a weakness in the authorization framework that governs attachment storage operations. This flaw operates at the application logic level and specifically targets the component responsible for managing file attachments within WeKan's collaborative board environment. The vulnerability's remote execution capability means that attackers do not require physical access to the system or local network privileges to exploit the flaw, making it particularly dangerous in internet-facing deployments where the application may be accessible to unauthenticated users.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it could potentially enable attackers to manipulate board data, access sensitive attachments, or even escalate privileges within the WeKan environment. The affected Attachment Storage Handler component is crucial for maintaining the integrity of user data and access controls, making this vulnerability particularly concerning for collaborative environments where multiple users share boards and attachments. Organizations relying on WeKan for project management, team collaboration, and document sharing face significant risk from this flaw, especially in environments where proper access controls are essential for maintaining data confidentiality and integrity.
Security practitioners should immediately implement the remediation measures recommended by the vendor, specifically upgrading to WeKan version 8.21 which includes the patch identified by commit hash 8c0b4f79d8582932528ec2fdf2a4487c86770fb9. This patch addresses the core authorization flaw in the applyWipLimit function by strengthening input validation and implementing proper access control checks for attachment storage operations. The vulnerability aligns with CWE-284 which describes improper access control issues, and represents a clear violation of the principle of least privilege. Organizations should also conduct comprehensive security assessments of their WeKan deployments to ensure that no other components may be susceptible to similar access control weaknesses. The ATT&CK framework categorizes this type of vulnerability under privilege escalation techniques, specifically targeting the T1078 adversary tactic for valid accounts and the T1566 technique for initial access through remote services, making this vulnerability particularly relevant for organizations implementing comprehensive threat hunting and incident response procedures.