CVE-2026-2207: WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure
A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component Activity Publication Handler. Executing a manipulation can lead to information disclosure. It is possible to launch the attack remotely. Upgrading to version 8.21 is capable of addressing this issue. This patch is called 91a936e07d2976d4246dfe834281c3aaa87f9503. You should upgrade the affected component.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2207?
The severity of CVE-2026-2207 is considered moderate due to the potential for information disclosure.
How do I fix CVE-2026-2207?
To fix CVE-2026-2207, update WeKan to version 8.21 or later, which addresses this vulnerability.
What impact does CVE-2026-2207 have on WeKan users?
CVE-2026-2207 could allow unauthorized users to gain access to sensitive information exposed through the Activity Publication Handler.
Is CVE-2026-2207 present in all WeKan versions?
CVE-2026-2207 affects all WeKan versions up to and including 8.20.
Who is affected by CVE-2026-2207?
Any WeKan users running version 8.20 or earlier are at risk due to CVE-2026-2207.