PT-2026-6945 · Wekan · Wekan

Megamansec · Published 2026-02-08 · Updated 2026-02-08 · CVE-2026-2206

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeKan versions prior to 8.21

Description A security flaw exists in WeKan up to version 8.20. The issue affects unknown code within the server/methods/fixDuplicateLists.js file of the Administrative Repair Handler component, leading to improper access controls. This allows for remote exploitation.

Recommendations Upgrade to version 8.21 to resolve the issue.

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2026-2206

Affected Products

Wekan

References · 11

• https://github.com/wekan/wekan/commit/4ce181d17249778094f73d21515f7f863f554743 · Patch
• https://github.com/wekan/wekan/releases/tag/v8.21 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-2206 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2206 · Vendor Advisory
• https://vuldb.com/?submit.752162 · Note
• https://vuldb.com/?id.344920 · Note
• https://twitter.com/CVEnew/status/2020356551526023230 · Twitter Post
• https://vuldb.com/?ctiid.344920 · Note
• https://github.com/wekan/wekan · Note
• https://t.me/cveNotify/151276 · Telegram Post
• https://t.me/CVEtracker/44076 · Telegram Post