Medium severity · published Feb 8, 2026
CVE-2026-2208
WeKan Rules rules.js RulesBleed authorization
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of the component Rules Handler. The manipulation leads to missing authorization. The attack can be initiated remotely. Upgrading to version 8.21 is recommended to address this issue. The identifier of the patch is a787bcddf33ca28afb13ff5ea9a4cb92dceac005. The affected component should be upgraded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
WeKan ·
8.0; 8.1; 8.2; 8.3; 8.4; 8.5; +15 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2208
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2208
Product
https://github.com/wekan/wekan/
Patch
https://github.com/wekan/wekan/commit/a787bcddf33ca28afb13ff5ea9a4cb92dceac005
Product
https://github.com/wekan/wekan/releases/tag/v8.21
Permissions Required
https://vuldb.com/?ctiid.344922
Third Party Advisory
https://vuldb.com/?id.344922
Third Party Advisory
https://vuldb.com/?submit.752164
More from WeKan
9.8
CVE-2026-1963
WeKan Attachment Storage attachments.js MoveStorageBleed access control
9.8
CVE-2026-1962
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
8.8
CVE-2026-2206
WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
6.3
CVE-2026-1898
WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control
6.3
CVE-2026-1896
WeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control