CVE-2026-2206CWE-266CWE-284

WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control

Medium · published February 8, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the component Administrative Repair Handler. Performing a manipulation results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to resolve this issue. The patch is named 4ce181d17249778094f73d21515f7f863f554743. It is advisable to upgrade the affected component.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00277 · 19.1th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-284 · Improper Access Control
Published
2026-02-08T01:09Z
EPSS history
Timeline
  • 08 FEB 01:09Z
    WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
    cvelistv5