CVE-2026-1963mediumCWE-266 CWE-284

CVE-2026-1963: falha de média gravidade em WeKan

WeKan Attachment Storage attachments.js MoveStorageBleed access control

Publicada em 05 fev 2026 · Atualizada em 23 fev 2026

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%

A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The manipulation results in improper access controls. The attack may be launched remotely. Upgrading to version 8.21 mitigates this issue. The patch is identified as c413a7e860bc4d93fe2adcf82516228570bf382d. Upgrading the affected component is advised.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X

Produtos afetados

n/a · WeKan

Referências

https://github.com/wekan/wekan/https://github.com/wekan/wekan/commit/c413a7e860bc4d93fe2adcf82516228570bf382d https://github.com/wekan/wekan/releases/tag/v8.21 https://vuldb.com/?ctiid.344485 https://vuldb.com/?id.344485 https://vuldb.com/?submit.742678