CVE-2026-1964
Improper Access Control in WeKan REST Endpoint Allows Remote Exploitation
Publication date: 2026-02-05
Last updated on: 2026-02-12
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wekan_project | wekan | to 8.21 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in WeKan versions up to 8.20, specifically in an unknown function within the file models/boards.js of the REST Endpoint component. It causes improper access controls, meaning that unauthorized users might gain access to certain functions or data they should not be able to access. The vulnerability can be exploited remotely.
Upgrading to version 8.21 of WeKan fixes this issue.
How can this vulnerability impact me? :
The vulnerability allows improper access control, which can lead to unauthorized access or manipulation of data or functions within the affected WeKan application. Since it can be exploited remotely, attackers might gain access without physical presence or prior authentication.
The impact is limited to integrity (I:P) as per CVSS v2.0 and v3.1 scores, meaning attackers could potentially modify data or functionality but not access confidential information or cause availability issues.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade WeKan to version 8.21, as this version contains the fix for the improper access control issue in the REST Endpoint component.