CVE-2026-2208 MEDIUM

CVE-2026-2208: WeKan Rules rules.js RulesBleed authorization

Vendor N/A
Product WeKan
Weakness CWE-862 · Missing authorization
Published February 8, 2026
Last update February 23, 2026

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X

What the vulnerability does

01Description

A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of the component Rules Handler. The manipulation leads to missing authorization. The attack can be initiated remotely. Upgrading to version 8.21 is recommended to address this issue. The identifier of the patch is a787bcddf33ca28afb13ff5ea9a4cb92dceac005. The affected component should be upgraded.

Key dates

02Disclosure timeline

February 8, 2026 CVE published
February 23, 2026 Record updated

Related vulnerabilities

04Related CVE