Paper/Archive/CVE-2026-1963

CVE-2026-1963

VulDB — WeKan Attachment Storage attachments.js MoveStorageBleed access control

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 30.2.302 × 206.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotely. Upgrading to version 8.21 mitigates this issue. The patch is identified as c413a7e860bc4d93fe2adcf82516228570bf382d. Upgrading the affected component is advised.

Affected

ProductAffectedFixed inSource

WeKan8.08.21CNA

WeKan8.18.21CNA

WeKan8.28.21CNA

WeKan8.38.21CNA

WeKan8.48.21CNA

WeKan8.58.21CNA

WeKan8.68.21CNA

WeKan8.78.21CNA

WeKan8.88.21CNA

WeKan8.98.21CNA

WeKan8.108.21CNA

WeKan8.118.21CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.344485 refvuldb.com/?ctiid.344485 writeupvuldb.com/?submit.742678 patchgithub.com/wekan/wekan/commit/c413a7e860bc4d93fe2adcf82516228570bf382d patchgithub.com/wekan/wekan/releases/tag/v8.21 refgithub.com/wekan/wekan