CVE-2026-2205: WeKan Meteor Publication cards.js CardPubSubBleed information disclosure
A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. Upgrading to version 8.21 is able to mitigate this issue. The name of the patch is 0f5a9c38778ca550cbab6c5093470e1e90cb837f. Upgrading the affected component is advised.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2205?
CVE-2026-2205 is considered a medium severity vulnerability due to the potential for information disclosure.
How do I fix CVE-2026-2205?
To fix CVE-2026-2205, you should upgrade WeKan to version 8.21 or later.
What components are affected by CVE-2026-2205?
CVE-2026-2205 affects the Meteor Publication Handler component specifically in the cards.js file.
What type of vulnerability is CVE-2026-2205?
CVE-2026-2205 is classified as an information disclosure vulnerability.
In which versions of WeKan is CVE-2026-2205 present?
CVE-2026-2205 is present in WeKan up to and including version 8.20.