CVE-2026-1963

Katalog CVE

CVSS 9.8 · Critical EPSS 0,36%

Kerentanan Incorrect Privilege Assignment pada wekan project wekan. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotely. Upgrading to version 8.21 mitigates this issue. The patch is identified as c413a7e860bc4d93fe2adcf82516228570bf382d. Upgrading the affected component is advised.

Rincian

Terbit di NVD

5 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-284: Improper Access Control

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wekan/wekan/commit/c413a7e860bc4d93fe2adcf82516228570bf382d patch
• https://vuldb.com/?id.344485 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.742678 advisory pihak ketiga · vdb entry
• https://github.com/wekan/wekan/ product
• https://github.com/wekan/wekan/releases/tag/v8.21 product · release notes
• https://vuldb.com/?ctiid.344485 permissions required · vdb entry