CVE-2026-2208

Katalog CVE

CVSS 6.5 · Medium EPSS 0,28%

Kerentanan Missing Authorization pada wekan project wekan. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of the component Rules Handler. The manipulation leads to missing authorization. The attack can be initiated remotely. Upgrading to version 8.21 is recommended to address this issue. The identifier of the patch is a787bcddf33ca28afb13ff5ea9a4cb92dceac005. The affected component should be upgraded.

Rincian

Terbit di NVD

8 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wekan/wekan/commit/a787bcddf33ca28afb13ff5ea9a4cb92dceac005 patch
• https://vuldb.com/?id.344922 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.752164 advisory pihak ketiga · vdb entry
• https://github.com/wekan/wekan/ product
• https://github.com/wekan/wekan/releases/tag/v8.21 product · release notes
• https://vuldb.com/?ctiid.344922 permissions required · vdb entry