CVE-2026-1898

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1898", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-04T14:46:30.516Z", "datePublished": "2026-02-05T00:32:09.720Z", "dateUpdated": "2026-02-23T09:17:56.116Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:17:56.116Z"}, "title": "WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "n/a", "product": "WeKan", "versions": [{"version": "8.0", "status": "affected"}, {"version": "8.1", "status": "affected"}, {"version": "8.2", "status": "affected"}, {"version": "8.3", "status": "affected"}, {"version": "8.4", "status": "affected"}, {"version": "8.5", "status": "affected"}, {"version": "8.6", "status": "affected"}, {"version": "8.7", "status": "affected"}, {"version": "8.8", "status": "affected"}, {"version": "8.9", "status": "affected"}, {"version": "8.10", "status": "affected"}, {"version": "8.11", "status": "affected"}, {"version": "8.12", "status": "affected"}, {"version": "8.13", "status": "affected"}, {"version": "8.14", "status": "affected"}, {"version": "8.15", "status": "affected"}, {"version": "8.16", "status": "affected"}, {"version": "8.17", "status": "affected"}, {"version": "8.18", "status": "affected"}, {"version": "8.19", "status": "affected"}, {"version": "8.20", "status": "affected"}, {"version": "8.21", "status": "unaffected"}], "modules": ["LDAP User Sync"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-02-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-05T15:05:36.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "MegaManSec (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.344270", "name": "VDB-344270 | WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.344270", "name": "VDB-344270 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.742676", "name": "Submit #742676 | Wekan <8.21 Missing authorization on admin function (CWE-284)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wekan/wekan/commit/146905a459106b5d00b4f09453a6554255e6965a", "tags": ["patch"]}, {"url": "https://github.com/wekan/wekan/releases/tag/v8.21", "tags": ["patch"]}, {"url": "https://github.com/wekan/wekan/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T15:20:50.609143Z", "id": "CVE-2026-1898", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T15:20:57.400Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1898", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T15:20:50.609143Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T15:20:53.824Z"}}], "cna": {"tags": ["x_open-source"], "title": "WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control", "credits": [{"lang": "en", "type": "reporter", "value": "MegaManSec (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"vendor": "n/a", "modules": ["LDAP User Sync"], "product": "WeKan", "versions": [{"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.1"}, {"status": "affected", "version": "8.2"}, {"status": "affected", "version": "8.3"}, {"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}, {"status": "affected", "version": "8.8"}, {"status": "affected", "version": "8.9"}, {"status": "affected", "version": "8.10"}, {"status": "affected", "version": "8.11"}, {"status": "affected", "version": "8.12"}, {"status": "affected", "version": "8.13"}, {"status": "affected", "version": "8.14"}, {"status": "affected", "version": "8.15"}, {"status": "affected", "version": "8.16"}, {"status": "affected", "version": "8.17"}, {"status": "affected", "version": "8.18"}, {"status": "affected", "version": "8.19"}, {"status": "affected", "version": "8.20"}, {"status": "unaffected", "version": "8.21"}]}], "timeline": [{"lang": "en", "time": "2026-02-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-04T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-05T15:05:36.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.344270", "name": "VDB-344270 | WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.344270", "name": "VDB-344270 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.742676", "name": "Submit #742676 | Wekan <8.21 Missing authorization on admin function (CWE-284)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wekan/wekan/commit/146905a459106b5d00b4f09453a6554255e6965a", "tags": ["patch"]}, {"url": "https://github.com/wekan/wekan/releases/tag/v8.21", "tags": ["patch"]}, {"url": "https://github.com/wekan/wekan/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:17:56.116Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1898", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:17:56.116Z", "dateReserved": "2026-02-04T14:46:30.516Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-05T00:32:09.720Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["LDAP User Sync"], "product": "WeKan", "vendor": "n/a", "versions": [{"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.1"}, {"status": "affected", "version": "8.2"}, {"status": "affected", "version": "8.3"}, {"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}, {"status": "affected", "version": "8.8"}, {"status": "affected", "version": "8.9"}, {"status": "affected", "version": "8.10"}, {"status": "affected", "version": "8.11"}, {"status": "affected", "version": "8.12"}, {"status": "affected", "version": "8.13"}, {"status": "affected", "version": "8.14"}, {"status": "affected", "version": "8.15"}, {"status": "affected", "version": "8.16"}, {"status": "affected", "version": "8.17"}, {"status": "affected", "version": "8.18"}, {"status": "affected", "version": "8.19"}, {"status": "affected", "version": "8.20"}, {"status": "unaffected", "version": "8.21"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*", "matchCriteriaId": "083807DE-F47B-4A75-916B-CDC9A3307747", "versionEndExcluding": "8.21", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en WeKan hasta la versi\u00f3n 8.20. Esto afecta una parte desconocida del archivo packages/wekan-ldap/server/syncUser.js del componente Sincronizaci\u00f3n de Usuarios LDAP. Esta manipulaci\u00f3n causa controles de acceso inadecuados. Es posible iniciar el ataque remotamente. La actualizaci\u00f3n a la versi\u00f3n 8.21 puede mitigar este problema. Nombre del parche: 146905a459106b5d00b4f09453a6554255e6965a. Deber\u00eda actualizar el componente afectado."}], "id": "CVE-2026-1898", "lastModified": "2026-06-17T10:16:41.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1898", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T15:20:50.609143Z", "version": "2.0.3"}}]}, "published": "2026-02-05T01:15:53.507", "references": [{"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://github.com/wekan/wekan/"}, {"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/wekan/wekan/commit/146905a459106b5d00b4f09453a6554255e6965a"}, {"source": "cna@vuldb.com", "tags": ["Release Notes"], "url": "https://github.com/wekan/wekan/releases/tag/v8.21"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.344270"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.344270"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.742676"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T13:42:02.159054+00:00", "value": {"mitigation_remediation": ["Upgrade the installation to WeKan 8.21 or later to apply the patch associated with commit 146905a459106b5d00b4f09453a6554255e6965a.", "If immediate upgrading is not possible, restrict external access to the LDAP sync API by configuring firewall rules or network segmentation so only trusted IPs can reach the endpoint.", "Ensure that the LDAP sync functionality is only invoked by authorized users; apply additional role\u2011based access control checks in the syncUser.js module if custom adjustments are required."], "summary": {"action": "Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The issue exists in WeKan up to version 8.20, specifically within packages/wekan-ldap/server/syncUser.js of the LDAP User Sync component. All releases prior to 8.21 are affected. Users running WeKan 8.21 or later are not susceptible to this flaw.", "description_and_impact": "A flaw in the LDAP User Sync component of WeKan allows improper access controls in the syncUser.js module, enabling remote actors to manipulate user synchronization. The vulnerability can lead to unauthorized access or modification of user accounts, exposing sensitive information and compromising data integrity.", "risk_and_exploitability": "The flaw carries a CVSS score of 5.3, indicating medium severity, and an EPSS probability of less than 1\u202f%. It is not listed in the CISA KEV catalog. Attackers can exploit the weakness remotely through the LDAP sync API; the CVE data does not explicitly state whether authentication is required, so it is inferred that inadequate authorization checks could allow such exploitation."}}}}, "created": "2026-02-05T11:39:06.341447+00:00", "updated": "2026-04-18T13:45:45.678171+00:00", "vendors": ["wekan_project", "wekan_project$PRODUCT$wekan"]}