VulnerabilityAnalyzed
CVE-2026-1898
A vulnerability was determined in WeKan up to 8.20.
MEDIUM 5.3EPSS 0.28%
Does this matter?
Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component.
- CVSS 4.0
- 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.28% probability · 20th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-266, CWE-284
- Affected
- wekan project/wekan
- Source
- cna@vuldb.com
References
- https://github.com/wekan/wekan/Product
- https://github.com/wekan/wekan/commit/146905a459106b5d00b4f09453a6554255e6965aPatch
- https://github.com/wekan/wekan/releases/tag/v8.21Release Notes
- https://vuldb.com/?ctiid.344270Permissions Required, VDB Entry
- https://vuldb.com/?id.344270Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.742676Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.