CVE-2026-1896

Katalog CVE

CVSS 6.3 · Medium EPSS 0,31%

Kerentanan Incorrect Privilege Assignment pada wekan project wekan. Skor CVSS 3.1 6.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/comprehensiveBoardMigration.js of the component Migration Operation Handler. The manipulation of the argument boardId leads to improper access controls. The attack is possible to be carried out remotely. Upgrading to version 8.21 addresses this issue. The identifier of the patch is cc35dafef57ef6e44a514a523f9a8d891e74ad8f. Upgrading the affected component is advised.

Rincian

Terbit di NVD

5 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-284: Improper Access Control

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wekan/wekan/commit/cc35dafef57ef6e44a514a523f9a8d891e74ad8f patch
• https://vuldb.com/?id.344268 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.742670 advisory pihak ketiga · vdb entry
• https://github.com/wekan/wekan/ product
• https://github.com/wekan/wekan/releases/tag/v8.21 release notes
• https://vuldb.com/?ctiid.344268 permissions required · vdb entry