CVE-2026-1964
Discovered by AISLEPUBLISHEDCWE-284CWE-266
Description
A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipulation causes improper access controls. Remote exploitation of the attack is possible. Upgrading to version 8.21 will fix this issue. Patch name: 545566f5663545d16174e0f2399f231aa693ab6e. It is advisable to upgrade the affected component.
CVSS Base Scores
CVSS v4.05.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
CVSS v3.1
4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C
CVSS v3.04.3
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C
CVSS v2.04.0
AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C
Affected Products
| Vendor | Product | Version | Status |
|---|---|---|---|
| n/a | WeKan | 8.0 | affected |
| n/a | WeKan | 8.1 | affected |
| n/a | WeKan | 8.2 | affected |
| n/a | WeKan | 8.3 | affected |
| n/a | WeKan | 8.4 | affected |
| n/a | WeKan | 8.5 | affected |
| n/a | WeKan | 8.6 | affected |
| n/a | WeKan | 8.7 | affected |
| n/a | WeKan | 8.8 | affected |
| n/a | WeKan | 8.9 | affected |
| n/a | WeKan | 8.10 | affected |
| n/a | WeKan | 8.11 | affected |
| n/a | WeKan | 8.12 | affected |
| n/a | WeKan | 8.13 | affected |
| n/a | WeKan | 8.14 | affected |
| n/a | WeKan | 8.15 | affected |
| n/a | WeKan | 8.16 | affected |
| n/a | WeKan | 8.17 | affected |
| n/a | WeKan | 8.18 | affected |
| n/a | WeKan | 8.19 | affected |
| n/a | WeKan | 8.20 | affected |
| n/a | WeKan | 8.21 | unaffected |
Credits
- MegaManSec (VulDB User)(reporter)