CVE Intelligence
Analysis AI-assisted

CVE-2026-1962: WeKan Attachment Migration Improper Access Control

A remotely initiable improper access control issue affects WeKan up to version 8.20 in its Attachment Migration component. The record states that version 8.21 resolves the issue and links a patch commit. The NVD assigns a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

WeKan is an open-source Kanban application. The record describes an improper access control issue in the Attachment Migration component, located in an unidentified function of server/attachmentMigration.js in versions up to 8.20. The vulnerability entry was published by VulDB as CNA, and the NVD record carries the 9.8 base score.

Impact

  • The record states that the manipulation leads to improper access controls and maps the issue to CWE-266.
  • The record states that the attack may be initiated remotely.
  • The NVD vector indicates no privileges and no user interaction are required, with high confidentiality, integrity and availability impact.
  • The CNA's own CVSS 3.1 score is 6.3, so providers disagree on severity.
  • The record does not describe which data or actions an attacker could reach in practice.

Affected products and versions

  • Product listed: Wekan Project Wekan.
  • Affected range listed: versions less than 8.21, described in the record as up to 8.20.
  • Fixed version stated in the record: 8.21.

Exploitation status

CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted. The record contains no EPSS or SSVC data.

Remediation and mitigation

  • Upgrade WeKan to version 8.21 or later, which the record identifies as the resolution.
  • Review the referenced patch commit to confirm the change in your deployment's codebase.
  • Until the upgrade is applied, limit network exposure of WeKan instances and restrict access to trusted users.
  • Check whether attachment migration functions are enabled in your installation and disable them where not needed.

Detection guidance

  • Inventory WeKan instances and flag any running a version below 8.21.
  • Review application and server logs for unusual requests to attachment-related functions, especially from unexpected sources.
  • Verify attachment ownership and access settings against expected state after any suspicious activity.

Limitations of the available information

The record does not name the specific function, the exact vulnerable endpoint, or any proof of concept. It does not specify the affected configuration, whether the migration feature is enabled by default, or the data exposed. No CWE name or EPSS data is provided.

Frequently asked questions

Which WeKan versions are affected?

The record lists WeKan versions less than 8.21, described as up to 8.20. The record states that upgrading to version 8.21 resolves the issue.

Is this vulnerability being actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted.

Why do the severity scores differ?

The NVD assigns a CVSS 3.1 base score of 9.8, while the CNA VulDB entry lists a CVSS 3.1 score of 6.3. The record does not explain the difference.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.