VulnerabilityAnalyzed
CVE-2026-2209
A vulnerability was detected in WeKan up to 8.18.
MEDIUM 5.3EPSS 0.20%
Does this matter?
Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in improper authorization. The attack can be launched remotely. Upgrading to version 8.19 is sufficient to fix this issue. The patch is identified as f244a43771f6ebf40218b83b9f46dba6b940d7de. It is suggested to upgrade the affected component.
- CVSS 4.0
- 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.20% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-266, CWE-285
- Affected
- wekan project/wekan
- Source
- cna@vuldb.com
References
- https://github.com/wekan/wekan/Product
- https://github.com/wekan/wekan/commit/f244a43771f6ebf40218b83b9f46dba6b940d7dePatch
- https://github.com/wekan/wekan/releases/tag/v8.19Product, Release Notes
- https://vuldb.com/?ctiid.344923Permissions Required, VDB Entry
- https://vuldb.com/?id.344923Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.752269Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.