What is the CVSS score of CVE-2026-2207?

CVE-2026-2207 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Wekan are affected by CVE-2026-2207?

Organizations using WeKan should be aware of moderate risk from CVE-2026-2207, a information exposure vulnerability rated CVSS 5.3. Sensitive information could be exposed to unauthorized parties.. A patch is available.

How to fix or mitigate CVE-2026-2207?

Within 30 days: Identify affected systems running WeKan and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Wekan CVE-2026-2207

MEDIUM

Information Exposure (CWE-200)

2026-02-08 cna@vuldb.com

Information Disclosure Wekan

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Feb 11, 2026 - 18:58 nvd

Patch available

CVE Published

Feb 08, 2026 - 02:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component Activity Publication Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. Upgrading to version 8.21 is capable of addressing this issue. This patch is called 91a936e07d2976d4246dfe834281c3aaa87f9503. You should upgrade the affected component.

AnalysisAI

WeKan versions up to 8.20 contain an information disclosure vulnerability in the Activity Publication Handler that allows unauthenticated remote attackers to access sensitive data through manipulation of the activities.js file. The vulnerability requires no user interaction and can be exploited over the network with low complexity. Users should upgrade to version 8.21 or apply patch 91a936e07d2976d4246dfe834281c3aaa87f9503 to remediate this issue.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Wekan. A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component Activity Publication Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. Upgrading to version 8.21 is capable of addressing this issue. This patch is called 91a936e07d2976d4246dfe834281c3aaa87f9503. You should upgrade the affected component.