CVE-2026-1963CWE-266CWE-284

WeKan Attachment Storage attachments.js MoveStorageBleed access control

Medium · published February 5, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotely. Upgrading to version 8.21 mitigates this issue. The patch is identified as c413a7e860bc4d93fe2adcf82516228570bf382d. Upgrading the affected component is advised.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00364 · 29.0th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-284 · Improper Access Control
Published
2026-02-05T21:02Z
EPSS history
Timeline
  • 05 FEB 21:02Z
    WeKan Attachment Storage attachments.js MoveStorageBleed access control
    cvelistv5