CVE-2026-1962

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1962", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-05T10:51:22.769Z", "datePublished": "2026-02-05T20:32:08.752Z", "dateUpdated": "2026-02-23T09:18:09.782Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:18:09.782Z"}, "title": "WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "n/a", "product": "WeKan", "versions": [{"version": "8.0", "status": "affected"}, {"version": "8.1", "status": "affected"}, {"version": "8.2", "status": "affected"}, {"version": "8.3", "status": "affected"}, {"version": "8.4", "status": "affected"}, {"version": "8.5", "status": "affected"}, {"version": "8.6", "status": "affected"}, {"version": "8.7", "status": "affected"}, {"version": "8.8", "status": "affected"}, {"version": "8.9", "status": "affected"}, {"version": "8.10", "status": "affected"}, {"version": "8.11", "status": "affected"}, {"version": "8.12", "status": "affected"}, {"version": "8.13", "status": "affected"}, {"version": "8.14", "status": "affected"}, {"version": "8.15", "status": "affected"}, {"version": "8.16", "status": "affected"}, {"version": "8.17", "status": "affected"}, {"version": "8.18", "status": "affected"}, {"version": "8.19", "status": "affected"}, {"version": "8.20", "status": "affected"}, {"version": "8.21", "status": "unaffected"}], "modules": ["Attachment Migration"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated remotely. Upgrading to version 8.21 is sufficient to resolve this issue. The identifier of the patch is 053bf1dfb76ef230db162c64a6ed50ebedf67eee. It is recommended to upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-02-05T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-05T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-12T20:27:57.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "MegaManSec (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.344484", "name": "VDB-344484 | WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.344484", "name": "VDB-344484 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.742677", "name": "Submit #742677 | Wekan <8.21 Improper access control on migration endpoints (CWE-284)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wekan/wekan/commit/053bf1dfb76ef230db162c64a6ed50ebedf67eee", "tags": ["patch"]}, {"url": "https://github.com/wekan/wekan/releases/tag/v8.21", "tags": ["patch"]}, {"url": "https://github.com/wekan/wekan/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-05T20:56:58.053925Z", "id": "CVE-2026-1962", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T20:57:22.291Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1962", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-05T20:56:58.053925Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-05T20:57:16.061Z"}}], "cna": {"tags": ["x_open-source"], "title": "WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control", "credits": [{"lang": "en", "type": "reporter", "value": "MegaManSec (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"vendor": "n/a", "modules": ["Attachment Migration"], "product": "WeKan", "versions": [{"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.1"}, {"status": "affected", "version": "8.2"}, {"status": "affected", "version": "8.3"}, {"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}, {"status": "affected", "version": "8.8"}, {"status": "affected", "version": "8.9"}, {"status": "affected", "version": "8.10"}, {"status": "affected", "version": "8.11"}, {"status": "affected", "version": "8.12"}, {"status": "affected", "version": "8.13"}, {"status": "affected", "version": "8.14"}, {"status": "affected", "version": "8.15"}, {"status": "affected", "version": "8.16"}, {"status": "affected", "version": "8.17"}, {"status": "affected", "version": "8.18"}, {"status": "affected", "version": "8.19"}, {"status": "affected", "version": "8.20"}, {"status": "unaffected", "version": "8.21"}]}], "timeline": [{"lang": "en", "time": "2026-02-05T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-05T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-12T20:27:57.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.344484", "name": "VDB-344484 | WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.344484", "name": "VDB-344484 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.742677", "name": "Submit #742677 | Wekan <8.21 Improper access control on migration endpoints (CWE-284)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/wekan/wekan/commit/053bf1dfb76ef230db162c64a6ed50ebedf67eee", "tags": ["patch"]}, {"url": "https://github.com/wekan/wekan/releases/tag/v8.21", "tags": ["patch"]}, {"url": "https://github.com/wekan/wekan/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated remotely. Upgrading to version 8.21 is sufficient to resolve this issue. The identifier of the patch is 053bf1dfb76ef230db162c64a6ed50ebedf67eee. It is recommended to upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T09:18:09.782Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1962", "state": "PUBLISHED", "dateUpdated": "2026-02-23T09:18:09.782Z", "dateReserved": "2026-02-05T10:51:22.769Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-05T20:32:08.752Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Attachment Migration"], "product": "WeKan", "vendor": "n/a", "versions": [{"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.1"}, {"status": "affected", "version": "8.2"}, {"status": "affected", "version": "8.3"}, {"status": "affected", "version": "8.4"}, {"status": "affected", "version": "8.5"}, {"status": "affected", "version": "8.6"}, {"status": "affected", "version": "8.7"}, {"status": "affected", "version": "8.8"}, {"status": "affected", "version": "8.9"}, {"status": "affected", "version": "8.10"}, {"status": "affected", "version": "8.11"}, {"status": "affected", "version": "8.12"}, {"status": "affected", "version": "8.13"}, {"status": "affected", "version": "8.14"}, {"status": "affected", "version": "8.15"}, {"status": "affected", "version": "8.16"}, {"status": "affected", "version": "8.17"}, {"status": "affected", "version": "8.18"}, {"status": "affected", "version": "8.19"}, {"status": "affected", "version": "8.20"}, {"status": "unaffected", "version": "8.21"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*", "matchCriteriaId": "083807DE-F47B-4A75-916B-CDC9A3307747", "versionEndExcluding": "8.21", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated remotely. Upgrading to version 8.21 is sufficient to resolve this issue. The identifier of the patch is 053bf1dfb76ef230db162c64a6ed50ebedf67eee. It is recommended to upgrade the affected component."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en WeKan hasta la versi\u00f3n 8.20. El elemento afectado es una funci\u00f3n desconocida del archivo server/attachmentMigration.js del componente Attachment Migration. La manipulaci\u00f3n conduce a controles de acceso inadecuados. El ataque puede iniciarse de forma remota. Actualizar a la versi\u00f3n 8.21 es suficiente para resolver este problema. El identificador del parche es 053bf1dfb76ef230db162c64a6ed50ebedf67eee. Se recomienda actualizar el componente afectado."}], "id": "CVE-2026-1962", "lastModified": "2026-06-17T10:16:47.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1962", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-05T20:56:58.053925Z", "version": "2.0.3"}}]}, "published": "2026-02-05T21:15:52.987", "references": [{"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://github.com/wekan/wekan/"}, {"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/wekan/wekan/commit/053bf1dfb76ef230db162c64a6ed50ebedf67eee"}, {"source": "cna@vuldb.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/wekan/wekan/releases/tag/v8.21"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.344484"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.344484"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.742677"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:59:22.254255+00:00", "value": {"mitigation_remediation": ["Upgrade the WeKan installation to version 8.21 or apply the patch commit 053bf1dfb76ef230db162c64a6ed50ebedf67eee to fix the issue.", "If an upgrade cannot be performed immediately, disable or restrict access to the attachment migration feature via configuration so that unauthenticated users cannot invoke it.", "Continuously monitor system logs for irregular attachment access patterns and respond to any unauthorized access attempts."], "summary": {"action": "Patch Now", "impact": "Unauthorized Access via Improper Access Control"}, "threat_synthesis": {"affected_systems": "All installations of the WeKan project up to version 8.20 are affected. The vendor, WeKan, publishes the issue in their releases and provides a patch in version 8.21, identified by commit 053bf1dfb76ef230db162c64a6ed50ebedf67eee. Users running earlier releases should update to 8.21 or apply the specific patch commit.", "description_and_impact": "A flaw exists in the file server/attachmentMigration.js component of WeKan, allowing an attacker to bypass normal access controls. The vulnerability is caused by an unknown function that does not enforce proper permission checks before processing attachment migrations. An attacker can therefore access or manipulate attachments intended to be restricted, potentially exposing sensitive data or altering attachment content. The weakness aligns with CWE\u2011266 (Privilege Escalation) and CWE\u2011284 (Improper Access Control).", "risk_and_exploitability": "The CVSS v3.1 score of 5.3 places the vulnerability in the moderate severity range, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability can be triggered remotely, and it is not listed in the CISA KEV catalog. Given the moderate impact and low exploitation likelihood, the overall risk is considered moderate, but it remains important to remediate promptly to eliminate the potential for unauthorized data access."}}}}, "created": "2026-02-06T12:05:02.774600+00:00", "updated": "2026-04-17T23:00:12.657745+00:00", "vendors": ["wekan_project", "wekan_project$PRODUCT$wekan"]}