Analysis Report · wekan v8.18 → v8.19 — CVE-2026-25560 CVE-2026-1962 CVE-2026-1963 CVE-2026-2206 CVE-2026-25859 CVE-2026-25564 CVE-2026-1892 CVE-2026-1894 CVE-2026-1895 CVE-2026-1896 CVE-2026-1897 CVE-2026-1898 CVE-2026-1964 CVE-2026-2205 C

--- cache/wekan_v8.18/client/components/settings/translationBody.js	2026-04-30 05:55:55.301025470 +0000+++ cache/wekan_v8.19/client/components/settings/translationBody.js	2026-04-30 05:55:58.393245898 +0000@@ -208,7 +208,7 @@ Template.settingsTranslationPopup.events({   'click #deleteButton'(event) {     event.preventDefault();-    Translation.remove(this.translationId);+    Meteor.call('deleteTranslation', this.translationId);     Popup.back();   } });

Vulnerability Existed: yes
TRUE POSITIVE
Insecure Direct Database Modification client/components/settings/translationBody.js Lines 208-210
Old Code
    Translation.remove(this.translationId);
Fixed Code
    Meteor.call('deleteTranslation', this.translationId);

Failed to fetch CVE description: HTTP 400

--- cache/wekan_v8.18/models/cardComments.js	2026-04-30 05:55:55.613047712 +0000+++ cache/wekan_v8.19/models/cardComments.js	2026-04-30 05:55:58.653264433 +0000@@ -313,8 +313,7 @@    *    * @param {string} boardId the board ID of the card    * @param {string} cardId the ID of the card-   * @param {string} authorId the user who 'posted' the comment-   * @param {string} text the content of the comment+   * @param {string} comment the content of the comment    * @return_type {_id: string}    */   JsonRoutes.add(@@ -326,7 +325,7 @@         const paramCardId = req.params.cardId;         Authentication.checkBoardAccess(req.userId, paramBoardId);         const id = CardComments.direct.insert({-          userId: req.body.authorId,+          userId: req.userId,           text: req.body.comment,           cardId: paramCardId,           boardId: paramBoardId,@@ -344,7 +343,7 @@           cardId: paramCardId,           boardId: paramBoardId,         });-        commentCreation(req.body.authorId, cardComment);+        commentCreation(req.userId, cardComment);       } catch (error) {         JsonRoutes.sendResult(res, {           code: 200,

Vulnerability Existed: yes
TRUE POSITIVE
Improper Authentication / User Impersonation models/cardComments.js lines 326,343
[Old Code]
          userId: req.body.authorId,
...
        commentCreation(req.body.authorId, cardComment);
[Fixed Code]
          userId: req.userId,
...
        commentCreation(req.userId, cardComment);

Failed to fetch CVE description: HTTP 400

--- cache/wekan_v8.18/models/lists.js	2026-04-30 05:55:55.637049423 +0000+++ cache/wekan_v8.19/models/lists.js	2026-04-30 05:55:58.657264718 +0000@@ -481,7 +481,7 @@       throw new Meteor.Error('list-not-found', 'List not found');     } -    const validUpdateFields = ['sort', 'swimlaneId'];+    const validUpdateFields = ['sort', 'swimlaneId', 'updatedAt', 'modifiedAt'];     Object.keys(updateData).forEach(field => {       if (!validUpdateFields.includes(field)) {         throw new Meteor.Error('invalid-field', `Field ${field} is not allowed`);@@ -685,7 +685,7 @@   JsonRoutes.add('POST', '/api/boards/:boardId/lists', function(req, res) {     try {       const paramBoardId = req.params.boardId;-      Authentication.checkBoardAccess(req.userId, paramBoardId);+      Authentication.checkBoardWriteAccess(req.userId, paramBoardId);       const board = ReactiveCache.getBoard(paramBoardId);       const id = Lists.insert({         title: req.body.title,@@ -731,7 +731,7 @@       const paramBoardId = req.params.boardId;       const paramListId = req.params.listId;       let updated = false;-      Authentication.checkBoardAccess(req.userId, paramBoardId);+      Authentication.checkBoardWriteAccess(req.userId, paramBoardId);        const list = ReactiveCache.getList({         _id: paramListId,@@ -871,7 +871,7 @@     try {       const paramBoardId = req.params.boardId;       const paramListId = req.params.listId;-      Authentication.checkBoardAccess(req.userId, paramBoardId);+      Authentication.checkBoardWriteAccess(req.userId, paramBoardId);       Lists.remove({ _id: paramListId, boardId: paramBoardId });       JsonRoutes.sendResult(res, {         code: 200,@@ -934,7 +934,7 @@   hasMovedFromOriginalPosition() {     const history = this.getOriginalPosition();     if (!history) return false;-    +     const currentSwimlaneId = this.swimlaneId || null;     return history.originalPosition.sort !== this.sort ||            history.originalSwimlaneId !== currentSwimlaneId;@@ -946,9 +946,9 @@   getOriginalPositionDescription() {     const history = this.getOriginalPosition();     if (!history) return 'No original position data';-    -    const swimlaneInfo = history.originalSwimlaneId ? -      ` in swimlane ${history.originalSwimlaneId}` : ++    const swimlaneInfo = history.originalSwimlaneId ?+      ` in swimlane ${history.originalSwimlaneId}` :       ' in default swimlane';     return `Original position: ${history.originalPosition.sort || 0}${swimlaneInfo}`;   },

Vulnerability Existed: yes
TRUE POSITIVE
Broken Access Control models/lists.js lines 685,731,871
Old Code
      Authentication.checkBoardAccess(req.userId, paramBoardId);
      Authentication.checkBoardAccess(req.userId, paramBoardId);
      Authentication.checkBoardAccess(req.userId, paramBoardId);
Fixed Code
      Authentication.checkBoardWriteAccess(req.userId, paramBoardId);
      Authentication.checkBoardWriteAccess(req.userId, paramBoardId);
      Authentication.checkBoardWriteAccess(req.userId, paramBoardId);

Failed to fetch CVE description: HTTP 400

--- cache/wekan_v8.18/public/api/wekan.yml	2026-04-30 05:55:55.909068814 +0000+++ cache/wekan_v8.19/public/api/wekan.yml	2026-04-30 05:55:58.801274984 +0000@@ -1115,12 +1115,6 @@         - multipart/form-data         - application/json       parameters:-        - name: authorId-          in: formData-          description: |-            the user who 'posted' the comment-          type: string-          required: true         - name: comment           in: formData           description: the comment value

Vulnerability Existed: yes
TRUE POSITIVE
Improper Access Control / Parameter Tampering public/api/wekan.yml lines 1115-1126
Old Code:
        - name: authorId
          in: formData
          description: |
            the user who 'posted' the comment
          type: string
          required: true
Fixed Code:
        - name: comment
          in: formData
          description: the comment value

Failed to fetch CVE description: HTTP 400