CVE-2026-1898
WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component.
| CWE | CWE-284 CWE-266 |
| Vendor | n/a |
| Product | wekan |
| Published | Feb 5, 2026 |
| Last Updated | Feb 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a wekan
Be the first to know when new medium vulnerabilities affecting n/a wekan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / WeKan
8.0 8.1 8.2 8.3 8.4 8.5 8.6 8.7 8.8 8.9 8.10 8.11 8.12 8.13 8.14 8.15 8.16 8.17 8.18 8.19 8.20
References
vuldb.com: https://vuldb.com/?id.344270 vuldb.com: https://vuldb.com/?ctiid.344270 vuldb.com: https://vuldb.com/?submit.742676 github.com: https://github.com/wekan/wekan/commit/146905a459106b5d00b4f09453a6554255e6965a github.com: https://github.com/wekan/wekan/releases/tag/v8.21 github.com: https://github.com/wekan/wekan/
Credits
🔍 MegaManSec (VulDB User)