CVE-2026-2209

Katalog CVE

CVSS 4.3 · Medium EPSS 0,22%

Kerentanan Incorrect Privilege Assignment pada wekan project wekan. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in improper authorization. The attack can be launched remotely. Upgrading to version 8.19 is sufficient to fix this issue. The patch is identified as f244a43771f6ebf40218b83b9f46dba6b940d7de. It is suggested to upgrade the affected component.

Rincian

Terbit di NVD

8 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-285: Improper Authorization

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/wekan/wekan/commit/f244a43771f6ebf40218b83b9f46dba6b940d7de patch
• https://vuldb.com/?id.344923 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.752269 advisory pihak ketiga · vdb entry
• https://github.com/wekan/wekan/ product
• https://github.com/wekan/wekan/releases/tag/v8.19 product · release notes
• https://vuldb.com/?ctiid.344923 permissions required · vdb entry