CVE-2026-1898: WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control

Q: What is the severity of CVE-2026-1898?

CVE-2026-1898 has a high severity due to improper access controls in the LDAP User Sync component.

Q: How do I fix CVE-2026-1898?

To fix CVE-2026-1898, upgrade WeKan to version 8.21 or later.

Q: What versions of WeKan are affected by CVE-2026-1898?

CVE-2026-1898 affects all versions of WeKan up to and including 8.20.

Q: What component is vulnerable in CVE-2026-1898?

The vulnerable component in CVE-2026-1898 is the LDAP User Sync functionality in syncUser.js.

Q: What type of vulnerability is CVE-2026-1898?

CVE-2026-1898 is classified as an access control vulnerability.

Published Feb 5, 2026

Updated

A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component.

Affected Software

2 affected components

wekan/wekan<=8.20

Wekan project Wekan<8.21

Remediation

Patch Available

https://github.com/wekan/wekan/commit/146905a459106b5d00b4f09453a6554255e6965a

Event History

Feb 5, 2026

CVE Published

via MITRE·12:32 AM

Data Sourced

via MITRE·12:32 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-1898?

CVE-2026-1898 has a high severity due to improper access controls in the LDAP User Sync component.

How do I fix CVE-2026-1898?