CVE-2026-1898

MEDIUM

Wekan < 8.21 - Improper Access Control in LDAP User Sync

Title source: llm
STIX 2.1

Description

A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.344270
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.344270
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.742676

Scores

CVSS v3 6.3
EPSS 0.0027
EPSS Percentile 17.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-284 CWE-266
Status published
Products (1)
wekan_project/wekan < 8.21
Published Feb 05, 2026
Tracked Since Feb 18, 2026