A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component.
References
| Link | Resource |
|---|---|
| https://github.com/wekan/wekan/ | Product |
| https://github.com/wekan/wekan/commit/146905a459106b5d00b4f09453a6554255e6965a | Patch |
| https://github.com/wekan/wekan/releases/tag/v8.21 | Release Notes |
| https://vuldb.com/?ctiid.344270 | Permissions Required VDB Entry |
| https://vuldb.com/?id.344270 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.742676 | Third Party Advisory VDB Entry |
Configurations
History
10 Feb 2026, 21:46
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wekan Project wekan
Wekan Project |
|
| CPE | cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* | |
| References | () https://github.com/wekan/wekan/ - Product | |
| References | () https://github.com/wekan/wekan/commit/146905a459106b5d00b4f09453a6554255e6965a - Patch | |
| References | () https://github.com/wekan/wekan/releases/tag/v8.21 - Release Notes | |
| References | () https://vuldb.com/?ctiid.344270 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.344270 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.742676 - Third Party Advisory, VDB Entry |
05 Feb 2026, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-05 01:15
Updated : 2026-02-10 21:46
NVD link : CVE-2026-1898
Mitre link : CVE-2026-1898
CVE.ORG link : CVE-2026-1898
JSON object : View
Products Affected
wekan_project
- wekan