CVE-2026-1897

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-1897
A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHistory.js of the component Position-History Tracking. The manipulation results in missing authorization. The attack may be performed from remote. Upgrading to version 8.21 can resolve this issue. The patch is identified as 55576ec17722db094835470b386162c9a662fb60. It is advisable to upgrade the affected component.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/wekan/wekan/ Product
https://github.com/wekan/wekan/commit/55576ec17722db094835470b386162c9a662fb60 Patch
https://github.com/wekan/wekan/releases/tag/v8.21 Release Notes
https://vuldb.com/?ctiid.344269 Permissions Required VDB Entry
https://vuldb.com/?id.344269 Third Party Advisory VDB Entry
https://vuldb.com/?submit.742671 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:16

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en WeKan hasta 8.20. Afectada por este problema es alguna funcionalidad desconocida del archivo server/methods/positionHistory.js del componente Position-History Tracking. La manipulación resulta en autorización faltante. El ataque puede ser realizado desde remoto. Actualizar a la versión 8.21 puede resolver este problema. El parche es identificado como 55576ec17722db094835470b386162c9a662fb60. Es aconsejable actualizar el componente afectado.

10 Feb 2026, 17:47

Type Values Removed Values Added
References () https://github.com/wekan/wekan/ - () https://github.com/wekan/wekan/ - Product
References () https://github.com/wekan/wekan/commit/55576ec17722db094835470b386162c9a662fb60 - () https://github.com/wekan/wekan/commit/55576ec17722db094835470b386162c9a662fb60 - Patch
References () https://github.com/wekan/wekan/releases/tag/v8.21 - () https://github.com/wekan/wekan/releases/tag/v8.21 - Release Notes
References () https://vuldb.com/?ctiid.344269 - () https://vuldb.com/?ctiid.344269 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.344269 - () https://vuldb.com/?id.344269 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.742671 - () https://vuldb.com/?submit.742671 - Third Party Advisory, VDB Entry
First Time Wekan Project wekan
Wekan Project
CPE cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*

05 Feb 2026, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-05 01:15

Updated : 2026-06-17 10:16

NVD link : CVE-2026-1897

Mitre link : CVE-2026-1897

CVE.ORG link : CVE-2026-1897

JSON object : View

Products Affected

wekan_project

  • wekan
CWE
CWE-862

Missing Authorization

CWE-863

Incorrect Authorization