Medium severity6.3NVD Advisory· Published Feb 5, 2026· Updated Jun 17, 2026
CVE-2026-1898
CVE-2026-1898
Description
A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
5- github.com/wekan/wekan/commit/146905a459106b5d00b4f09453a6554255e6965anvdPatch
- vuldb.comnvdThird Party AdvisoryVDB Entry
- vuldb.comnvdThird Party AdvisoryVDB Entry
- github.com/wekan/wekan/releases/tag/v8.21nvdRelease Notes
- vuldb.comnvdPermissions RequiredVDB Entry
News mentions
0No linked articles in our index yet.