CVE-2026-2207

MEDIUM 5.3

WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component Activity Publication Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. Upgrading to version 8.21 is capable of addressing this issue. This patch is called 91a936e07d2976d4246dfe834281c3aaa87f9503. You should upgrade the affected component.

CWE	CWE-200 CWE-284
Vendor	n/a
Product	wekan
Published	Feb 8, 2026
Last Updated	Feb 23, 2026

Stay Ahead of the Next One

Get instant alerts for n/a wekan

Be the first to know when new medium vulnerabilities affecting n/a wekan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / WeKan

8.0 8.1 8.2 8.3 8.4 8.5 8.6 8.7 8.8 8.9 8.10 8.11 8.12 8.13 8.14 8.15 8.16 8.17 8.18 8.19 8.20

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/?id.344921 vuldb.com: https://vuldb.com/?ctiid.344921 vuldb.com: https://vuldb.com/?submit.752163 github.com: https://github.com/wekan/wekan/commit/91a936e07d2976d4246dfe834281c3aaa87f9503 github.com: https://github.com/wekan/wekan/releases/tag/v8.21 github.com: https://github.com/wekan/wekan/

Credits

🔍 MegaManSec (VulDB User)