PT-2026-6630 · Wekan · Wekan

Megamansec · Published 2026-02-05 · Updated 2026-02-05 · CVE-2026-1962

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeKan versions up to 8.20

Description A flaw exists in WeKan that relates to improper access controls. The issue is located in an unknown function within the server/attachmentMigration.js file of the Attachment Migration component. This issue can be exploited remotely.

Recommendations Upgrade to version 8.21 to resolve this issue.

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2026-1962

Affected Products

Wekan

References · 10

• https://github.com/wekan/wekan/commit/053bf1dfb76ef230db162c64a6ed50ebedf67eee · Patch
• https://github.com/wekan/wekan/releases/tag/v8.21 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1962 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1962 · Vendor Advisory
• https://vuldb.com/?submit.742677 · Note
• https://github.com/wekan/wekan · Note
• https://vuldb.com/?ctiid.344484 · Note
• https://vuldb.com/?id.344484 · Note
• https://t.me/CVEtracker/43867 · Telegram Post
• https://twitter.com/CVEnew/status/2019516497337389347 · Twitter Post