CVE-2026-2206
Improper Access Control in WeKan Administrative Repair Handler
Publication date: 2026-02-08
Last updated on: 2026-02-11
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wekan_project | wekan | to 8.21 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2206 is an improper access control vulnerability in WeKan versions up to 8.20. It affects the server method responsible for repairing duplicate lists and swimlanes, specifically in the file server/methods/fixDuplicateLists.js within the Administrative Repair Handler component.
The flaw occurs because the method did not enforce instance-admin authorization checks, allowing non-administrative users to execute administrative repair workflows that should have been restricted to instance administrators only.
This vulnerability can be exploited remotely without local access, enabling unauthorized users to perform actions reserved for administrators.
The issue was fixed in WeKan version 8.21 by adding strict admin authorization checks to ensure only instance admins can perform the repair operation.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to bypass access controls and perform administrative repair operations remotely.
Such unauthorized access can compromise the confidentiality, integrity, and availability of your WeKan system.
Attackers could manipulate duplicate lists and swimlanes, potentially disrupting workflows and data consistency.
Because the vulnerability is remotely exploitable without user interaction, it increases the risk of unauthorized administrative actions.
The CVSS v3.1 base score of 6.3 indicates a moderate severity level, meaning the impact is significant but not critical.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves improper access control in the WeKan server method fixDuplicateLists.js, allowing non-admin users to perform administrative repair operations remotely.'}, {'type': 'paragraph', 'content': 'Detection can focus on monitoring unauthorized attempts to invoke the duplicate list fixing workflow or related administrative repair functions.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is related to missing admin authorization checks, you can detect exploitation attempts by checking server logs for calls to the fixDuplicateLists method by non-admin users.'}, {'type': 'paragraph', 'content': "Suggested commands include searching application logs for unauthorized access attempts or errors indicating 'not-authorized' or 'Admin required' messages related to fixDuplicateLists.js."}, {'type': 'list_item', 'content': "grep -i 'fixDuplicateLists' /path/to/wekan/logs/*"}, {'type': 'list_item', 'content': "grep -i 'not-authorized' /path/to/wekan/logs/*"}, {'type': 'list_item', 'content': "grep -i 'Admin required' /path/to/wekan/logs/*"}, {'type': 'paragraph', 'content': 'Additionally, monitoring network traffic for unusual API calls to the administrative repair endpoints from non-admin IPs could help detect exploitation attempts.'}] [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
The primary and recommended mitigation is to upgrade WeKan to version 8.21 or later, which includes the security patch that enforces strict admin authorization checks on the fixDuplicateLists method.
This patch prevents non-administrative users from executing administrative repair workflows, thereby closing the access control gap.
If immediate upgrade is not possible, restrict access to the affected administrative repair endpoints to trusted administrators only, for example by network segmentation or firewall rules.
Also, monitor logs for unauthorized access attempts and consider temporarily disabling or restricting the repair workflow functionality until the patch can be applied.