CVE-2026-2205
Last modified
CVE-2026-2205 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication Handler. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. Upgrading to version 8.21 is able to mitigate this issue. The name of the patch is 0f5a9c38778ca550cbab6c5093470e1e90cb837f. Upgrading the affected component is advised.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wekan Project | Wekan | < 8.21 |
References
- https://github.com/wekan/wekan/releases/tag/v8.21Product, Release Notes
- https://vuldb.com/?ctiid.344919Permissions Required, VDB Entry
- https://vuldb.com/?id.344919Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.752161Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-2205?
How severe is CVE-2026-2205?
How do I fix CVE-2026-2205?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-22044GLPI is a free asset and IT management software package. Fro…8.8
- CVE-2026-22045Traefik is an HTTP reverse proxy and load balancer. Prior to…7.5
- CVE-2026-22046iccDEV provides a set of libraries and tools that allow for …8.8
- CVE-2026-22047iccDEV provides a set of libraries and tools that allow for …8.8
- CVE-2026-22048StorageGRID (formerly StorageGRID Webscale) versions prior t…7.1
- CVE-2026-22049ONTAP versions 9.16.1 and higher with WebAuthn multi-factor …8.7
- CVE-2026-22050ONTAP versions 9.16.1 prior to 9.16.1P9 and 9.17.1 prior to …4.3
- CVE-2026-22051StorageGRID (formerly StorageGRID Webscale) versions prior t…4.3
- CVE-2026-22052ONTAP versions 9.12.1 and higher with S3 NAS buckets are sus…4.3
- CVE-2026-22054Active IQ Config Advisor version 6.7.3 contains hard-coded c…8.8
- CVE-2026-22055Active IQ OneCollect version 2.7.3 contains hard-coded crede…8.8
- CVE-2026-2206A security flaw has been discovered in WeKan up to 8.20. Thi…8.8
Are you affected by CVE-2026-2205?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST