CVE-2026-1962

MEDIUM

Wekan < 8.21 - Improper Access Controls in Attachment Migration

Title source: llm
STIX 2.1

Description

A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated remotely. Upgrading to version 8.21 is sufficient to resolve this issue. The identifier of the patch is 053bf1dfb76ef230db162c64a6ed50ebedf67eee. It is recommended to upgrade the affected component.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.344484
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.344484
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.742677

Scores

CVSS v3 6.3
EPSS 0.0032
EPSS Percentile 23.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-266 CWE-284
Status published
Products (1)
wekan_project/wekan < 8.21
Published Feb 05, 2026
Tracked Since Feb 18, 2026