CVE-2026-1962 is a medium severity improper access control flaw (CVSS 6.3) in WeKan up to version 8.20. It sits in the attachment migration component. WeKan 8.21 resolves it, so upgrade the server and review who can reach your board data.
What's affected
WeKan up to and including 8.20 is affected. The CVE record says upgrading to 8.21 is sufficient and names the fixing commit. The flaw is in server/attachmentMigration.js. It needs a low privilege account and can be started over the network.
How to check if you're exposed
Find the WeKan version from the About page or your container tag or Snap channel. Any version up to 8.20 should be updated. If you deploy from source, check that your checkout includes the fix commit listed in the record.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in.
What to do now
- Back up the WeKan database and attachment storage.
- Upgrade to WeKan 8.21 or later.
- Review user accounts and remove those that no longer need access.
- After the upgrade, confirm that attachments still open for the right users.
Why it matters
The weaknesses are CWE-284, improper access control, and CWE-266, incorrect privilege assignment. In plain terms, the migration code lets a user do more with attachments than the permission model intends.
The score is medium because it needs a login and the impact on each of confidentiality, integrity and availability is low. A shared board server with many users still deserves the update. It is a sibling of CVE-2026-1963, fixed in the same release. The CVE is not in CISA's KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What fixes it?
WeKan 8.21, according to the record.
Is it the same bug as CVE-2026-1963?
No. It is a separate flaw in attachment storage, fixed in the same release.
Sources
Last reviewed: 19 October 2026.
