CVE-2026-1897

WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization

CVSS 5.3 MEDIUMEPSS 0.3%CWE-862 CWE-863

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.3EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

05 feb 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHistory.js of the component Position-History Tracking. The manipulation results in missing authorization. The attack may be performed from remote. Upgrading to version 8.21 can resolve this issue. The patch is identified as 55576ec17722db094835470b386162c9a662fb60. It is advisable to upgrade the affected component.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

Productos afectados

n/a · WeKan

Referencias

https://github.com/wekan/wekan/https://github.com/wekan/wekan/commit/55576ec17722db094835470b386162c9a662fb60 https://github.com/wekan/wekan/releases/tag/v8.21 https://vuldb.com/?ctiid.344269 https://vuldb.com/?id.344269 https://vuldb.com/?submit.742671