CVE-2026-1962

A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Attachment Migration. The manipulation leads to improper access controls. The attack may be initiated remotely. Upgrading to version 8.21 is sufficient to resolve this issue. The identifier of the patch is 053bf1dfb76ef230db162c64a6ed50ebedf67eee. It is recommended to upgrade the affected component.

• CWE-266
• CWE-284

• https://github.com/wekan/wekan/Product
• https://github.com/wekan/wekan/commit/053bf1dfb76ef230db162c64a6ed50ebedf67eeePatch
• https://github.com/wekan/wekan/releases/tag/v8.21Product, Release Notes
• https://vuldb.com/?ctiid.344484Permissions Required, VDB Entry
• https://vuldb.com/?id.344484Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.742677Third Party Advisory, VDB Entry

Published

Feb 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19613The ECS WordPress plugin before 4.3.10 does not perform own…6.5
• CVE-2026-19614The API is prone to XML external entity (XXE) injection. By …5.3
• CVE-2026-19615The Admin and Site Enhancements (ASE) WordPress plugin befor…6.8
• CVE-2026-19616Missing Authorization vulnerability in TBC Technology Inc. K…7.5
• CVE-2026-19617A flaw was found in libdm. A local attacker could craft a ma…5.5
• CVE-2026-19619GitLab has remediated an issue in GitLab CE/EE affecting all…4.7
• CVE-2026-19620IBM Planning Analytics 2.0, and 2.1 could allow a remote att…8.8
• CVE-2026-19621Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11…6.5
• CVE-2026-19622IBM Planning Analytics 2.0, and 2.1 could allow a remote att…9.8
• CVE-2026-19624A flaw was found in NetworkManager-l2tp. The plugin writes a…7.8
• CVE-2026-19625When a Quarkus application has multiple endpoints secured by…5.3
• CVE-2026-19626A remote code execution vulnerability exists in Tenable Secu…9.9