TI-2026-01855 Aliases CVE-2026-2207 GHSA-p69q-x7rq-85qp

WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure

HIGH 70CWE-200Published 2026-02-08 · Updated 2026-02-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.

Summary

A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component Activity Publication Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. Upgrading to version 8.21 is capable of addressing this issue. This patch is called 91a936e07d2976d4246dfe834281c3aaa87f9503. You should upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00407 35th percentileScored 2026-11-07

Fix Fixed WeKan: 8.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	WeKan	8.0; 8.1; 8.2; 8.3; 8.4; 8.5; 8.6; 8.7; 8.8; 8.9; 8.10; 8.11; 8.12; 8.13; 8.14; 8.15; 8.16; 8.17; 8.18; 8.19; 8.20	8.21	Patch available	CNA

WeKan Vendor— Affected 8.0; 8.1; 8.2; 8.3; 8.4; 8.5; 8.6; 8.7; 8.8; 8.9; 8.10; 8.11; 8.12; 8.13; 8.14; 8.15; 8.16; 8.17; 8.18; 8.19; 8.20 Fixed in 8.21 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wekan_project:wekan::::::::	before 8.21	Vulnerable	wekan

cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* Versions before 8.21 Vulnerable ·wekan

Remediation

Fix · CNA WeKan Fixed in 8.21

Timeline

2026-10-02 Threatist record created from CVE-2026-2207
2026-10-03 Alias added: GHSA-p69q-x7rq-85qp

References

Patch 2

Other 1

https://github.com/wekan/wekan/

TI-2023-13025 A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before… CVSS 3.1MEDIUM 5.4
TI-2026-20667 WeKan < 8.19 LDAP Authentication Filter Injection CVSS 4.0HIGH 8.7
TI-2026-23675 Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication CVSS 4.0HIGH 8.7
TI-2026-23673 Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading CVSS 4.0CRITICAL 9.3
TI-2026-23672 Wekan has Cross-Board IDOR in Custom Fields Update Endpoints CVSS 4.0CRITICAL 9.3
TI-2025-40439 An issue was discovered in Wekan The Open Source kanban board system up to version 18.15… CVSS 3.1HIGH 8.2

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences