Improper Access Control in WeKan Affects Attachment Storage Component

CVE-2026-1963

What is CVE-2026-1963?

A flaw has been discovered in WeKan's Attachment Storage component, specifically within the models/attachments.js file, which leads to improper access control. This vulnerability allows unauthorized actors to remotely exploit the component, potentially leading to unauthorized access to sensitive data. Users are strongly recommended to upgrade to version 8.21 or higher, where this issue has been effectively addressed through an important patch. To ensure your system's integrity, apply the necessary updates promptly.

References