What’s Vulnerable › Vulnerabilities

CVE-2026-2206: WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-08 · updated 2026-06-17
• Weakness: CWE-266

Description

A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the component Administrative Repair Handler. Performing a manipulation results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to resolve this issue. The patch is named 4ce181d17249778094f73d21515f7f863f554743. It is advisable to upgrade the affected component.

Affected products

• WeKan: before 8.21 — fixed in 8.21

How to fix

Upgrade to a fixed version: WeKan 8.21. Check the vendor advisory for mitigations.

References

• https://github.com/wekan/wekan/
• https://github.com/wekan/wekan/commit/4ce181d17249778094f73d21515f7f863f554743
• https://github.com/wekan/wekan/releases/tag/v8.21
• https://vuldb.com/?ctiid.344920
• https://vuldb.com/?id.344920
• https://vuldb.com/?submit.752162

Get alerted when CVE-2026-2206 or the next vulnerability affects your stack