by Kastro
Paper/Archive/CVE-2026-1962

CVE-2026-1962

VulDB — WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 30.2.302 × 206.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated remotely. Upgrading to version 8.21 is sufficient to resolve this issue. The identifier of the patch is 053bf1dfb76ef230db162c64a6ed50ebedf67eee. It is recommended to upgrade the affected component.

Affected

ProductAffectedFixed inSource
WeKan8.08.21CNA
WeKan8.18.21CNA
WeKan8.28.21CNA
WeKan8.38.21CNA
WeKan8.48.21CNA
WeKan8.58.21CNA
WeKan8.68.21CNA
WeKan8.78.21CNA
WeKan8.88.21CNA
WeKan8.98.21CNA
WeKan8.108.21CNA
WeKan8.118.21CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.344484refvuldb.com/?ctiid.344484writeupvuldb.com/?submit.742677patchgithub.com/wekan/wekan/commit/053bf1dfb76ef230db162c64a6ed50ebedf67eeepatchgithub.com/wekan/wekan/releases/tag/v8.21refgithub.com/wekan/wekan