CVE-2026-1963

Published: Feb 5, 2026Modified: Mar 6, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: CNA (Secondary)

Description

A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotely. Upgrading to version 8.21 mitigates this issue. The patch is identified as c413a7e860bc4d93fe2adcf82516228570bf382d. Upgrading the affected component is advised.

Affected (1)

Products: Wekan Project: Wekan

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wekan Project Wekan	Before 8.21

Related CWEs

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (6)

https://github.com/wekan/wekan/

Source: cna@vuldb.com

Product

https://github.com/wekan/wekan/commit/c413a7e860bc4d93fe2adcf82516228570bf382d

Source: cna@vuldb.com

Patch

https://github.com/wekan/wekan/releases/tag/v8.21

Source: cna@vuldb.com

ProductRelease Notes

https://vuldb.com/?ctiid.344485

Source: cna@vuldb.com

Permissions RequiredVDB Entry

https://vuldb.com/?id.344485

Source: cna@vuldb.com

Third Party AdvisoryVDB Entry

https://vuldb.com/?submit.742678

Source: cna@vuldb.com

Third Party AdvisoryVDB Entry

Timeline

No history available yet.