CVE-2026-1963 is a medium severity improper access control flaw (CVSS 6.3) in WeKan up to version 8.20. It affects the attachment storage component. WeKan 8.21 mitigates it, per the CVE record, so upgrade the server and check who has access to your boards.
What's affected
WeKan up to and including 8.20 is affected. The flaw is in models/attachments.js. The record says upgrading to 8.21 mitigates it and names the patch commit. A low privilege account and network access are enough to try it.
How to check if you're exposed
Check the WeKan version on the About page, your container tag, or your Snap channel. Up to 8.20 means affected. If you build from source, confirm the patch commit from the record is in your tree.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in.
What to do now
- Back up the database and attachment storage.
- Upgrade to WeKan 8.21 or later.
- Remove accounts that no longer need board access.
- Check that attachment permissions still match your boards.
Why it matters
The record lists CWE-284, improper access control, and CWE-266, incorrect privilege assignment. Attachment storage code applies permissions in a way that lets users reach more than they should.
The impact scores are low on each axis, and a login is required, so the overall rating is medium. It travels with CVE-2026-1962 in the same release. The CVE is not in CISA's KEV list.
Quick check
Is 8.21 the fix?
The record says upgrading to 8.21 mitigates the issue.
Does it need an account?
Yes, a low privilege account per the vector.
Sources
Last reviewed: 19 October 2026.
