CVE Intelligence
Analysis AI-assisted

CVE-2026-1963: WeKan Improper Access Control in Attachment Storage

CVE-2026-1963 affects WeKan up to version 8.20 and is classified as an improper access control issue in the Attachment Storage component. The record states that the issue can be triggered remotely and that upgrading to version 8.21 mitigates it. NVD scores it 9.8 (critical) under CVSS 3.1, the CNA scores are lower, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-1963 is an improper access control issue in the Attachment Storage component of WeKan. The record places the weakness in models/attachments.js and maps it to CWE-266. According to the record, the issue can be triggered remotely and is addressed in version 8.21.

Impact

  • The record describes the manipulation as resulting in improper access controls. Attachments may be reachable by parties who should not have access, which is an inference from that description.
  • NVD rates the vulnerability 9.8 (critical) under CVSS 3.1, with a vector of network attack, low complexity, no privileges and no user interaction, and high impact on confidentiality, integrity and availability.
  • The CNA VulDB scores are 5.3 under CVSS 4.0, 6.3 under CVSS 3.1 and 6.5 under CVSS 2.0.

Affected products and versions

  • Product: Wekan Project Wekan.
  • Affected range: versions below 8.21, which the record describes as up to 8.20.
  • Fixed version: 8.21, as stated in the record and the release reference.
  • Patch commit: c413a7e860bc4d93fe2adcf82516228570bf382d.

Exploitation status

CISA KEV does not list this CVE. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. EPSS and SSVC data are not present in the record.

Remediation and mitigation

  • Upgrade WeKan to version 8.21 or later, as the record advises upgrading the affected component.
  • Review the patch commit and the release notes to confirm the fix is present in the deployed build.
  • If an upgrade cannot happen immediately, limit network exposure of the WeKan instance and review attachment access permissions. The record does not describe a vendor-confirmed workaround, so these are general hardening measures.

Detection guidance

  • Inventory all WeKan deployments and record their versions to identify any instance running 8.20 or earlier.
  • Review application logs and attachment access records for access by users or sessions that should not have it.
  • Monitor remote access to the WeKan service for unusual patterns at a general level.

Limitations of the available information

  • The record does not identify the specific function in models/attachments.js and does not describe the exact conditions required for the issue.
  • The CWE name is not provided, and the scores from different providers disagree.
  • EPSS and SSVC data are absent, so exploitation likelihood cannot be assessed from the record.
  • This analysis does not include technical exploitation details.

Frequently asked questions

Which WeKan versions are affected by CVE-2026-1963?

The record states that WeKan up to version 8.20 is affected, and lists the affected range as versions below 8.21.

Is CVE-2026-1963 being actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted.

What should administrators do?

Upgrade WeKan to version 8.21 or later, verify the patch commit is included in the deployed build, and review attachment access permissions while planning the upgrade.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.