{"id":"CVE-2026-2206","state":"PUBLISHED","title":"WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control","description":"A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the component Administrative Repair Handler. Performing a manipulation results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to resolve this issue. The patch is named 4ce181d17249778094f73d21515f7f863f554743. It is advisable to upgrade the affected component.","publishedAt":"2026-02-08T01:09:36.037Z","updatedAt":"2026-02-23T09:54:07.822Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","source":"VulDB"},"assigner":"VulDB","products":["n/a WeKan"],"affected":[{"vendor":"n/a","product":"WeKan","versions":[{"version":"8.0","status":"affected"},{"version":"8.1","status":"affected"},{"version":"8.2","status":"affected"},{"version":"8.3","status":"affected"},{"version":"8.4","status":"affected"},{"version":"8.5","status":"affected"},{"version":"8.6","status":"affected"},{"version":"8.7","status":"affected"},{"version":"8.8","status":"affected"},{"version":"8.9","status":"affected"},{"version":"8.10","status":"affected"},{"version":"8.11","status":"affected"},{"version":"8.12","status":"affected"},{"version":"8.13","status":"affected"},{"version":"8.14","status":"affected"},{"version":"8.15","status":"affected"},{"version":"8.16","status":"affected"},{"version":"8.17","status":"affected"},{"version":"8.18","status":"affected"},{"version":"8.19","status":"affected"},{"version":"8.20","status":"affected"},{"version":"8.21","status":"unaffected"}],"modules":["Administrative Repair Handler"]}],"references":["https://vuldb.com/?id.344920","https://vuldb.com/?ctiid.344920","https://vuldb.com/?submit.752162","https://github.com/wekan/wekan/commit/4ce181d17249778094f73d21515f7f863f554743","https://github.com/wekan/wekan/releases/tag/v8.21","https://github.com/wekan/wekan/"],"weaknesses":["CWE-284","CWE-266"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/2xxx/CVE-2026-2206.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-2206","state":"PUBLISHED","datePublished":"2026-02-08T01:09:36.037Z","dateUpdated":"2026-02-23T09:54:07.822Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-02-08T01:06:06.190Z"},"containers":{"cna":{"title":"WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control","descriptions":[{"lang":"en","value":"A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the component Administrative Repair Handler. Performing a manipulation results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to resolve this issue. The patch is named 4ce181d17249778094f73d21515f7f863f554743. It is advisable to upgrade the affected component."}],"affected":[{"vendor":"n/a","product":"WeKan","versions":[{"version":"8.0","status":"affected"},{"version":"8.1","status":"affected"},{"version":"8.2","status":"affected"},{"version":"8.3","status":"affected"},{"version":"8.4","status":"affected"},{"version":"8.5","status":"affected"},{"version":"8.6","status":"affected"},{"version":"8.7","status":"affected"},{"version":"8.8","status":"affected"},{"version":"8.9","status":"affected"},{"version":"8.10","status":"affected"},{"version":"8.11","status":"affected"},{"version":"8.12","status":"affected"},{"version":"8.13","status":"affected"},{"version":"8.14","status":"affected"},{"version":"8.15","status":"affected"},{"version":"8.16","status":"affected"},{"version":"8.17","status":"affected"},{"version":"8.18","status":"affected"},{"version":"8.19","status":"affected"},{"version":"8.20","status":"affected"},{"version":"8.21","status":"unaffected"}],"modules":["Administrative Repair Handler"]}],"references":[{"url":"https://vuldb.com/?id.344920","name":"VDB-344920 | WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.344920","name":"VDB-344920 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.752162","name":"Submit #752162 | Wekan <8.21 Improper access control on administrative repair method","tags":["third-party-advisory"]},{"url":"https://github.com/wekan/wekan/commit/4ce181d17249778094f73d21515f7f863f554743","tags":["patch"]},{"url":"https://github.com/wekan/wekan/releases/tag/v8.21","tags":["patch"]},{"url":"https://github.com/wekan/wekan/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","type":"CWE","lang":"en","description":"Improper Access Controls"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-02-23T09:54:07.822Z"},"timeline":[{"time":"2026-02-08T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-02-08T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-02-12T08:47:13.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"MegaManSec (VulDB User)","type":"reporter"}],"tags":["x_open-source"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-02-10T19:38:54.022899Z","id":"CVE-2026-2206","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-10T19:39:08.567Z"}}]}}}