CVE-2026-1897CWE-862CWE-863

WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization

Medium · published February 5, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHistory.js of the component Position-History Tracking. The manipulation results in missing authorization. The attack may be performed from remote. Upgrading to version 8.21 can resolve this issue. The patch is identified as 55576ec17722db094835470b386162c9a662fb60. It is advisable to upgrade the affected component.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00338 · 26.0th percentile
Weaknesses
CWE-862 · Missing Authorization; CWE-863 · Incorrect Authorization
Published
2026-02-05T00:02Z
EPSS history
Timeline
  • 05 FEB 00:02Z
    WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization
    cvelistv5