Description
A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component.
Published: 2026-02-05
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch
AI Analysis

Impact

A flaw in the LDAP User Sync component of WeKan allows improper access controls in the syncUser.js module, enabling remote actors to manipulate user synchronization. The vulnerability can lead to unauthorized access or modification of user accounts, exposing sensitive information and compromising data integrity.

Affected Systems

The issue exists in WeKan up to version 8.20, specifically within packages/wekan-ldap/server/syncUser.js of the LDAP User Sync component. All releases prior to 8.21 are affected. Users running WeKan 8.21 or later are not susceptible to this flaw.

Risk and Exploitability

The flaw carries a CVSS score of 5.3, indicating medium severity, and an EPSS probability of less than 1 %. It is not listed in the CISA KEV catalog. Attackers can exploit the weakness remotely through the LDAP sync API; the CVE data does not explicitly state whether authentication is required, so it is inferred that inadequate authorization checks could allow such exploitation.

Generated by OpenCVE AI on April 18, 2026 at 13:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the installation to WeKan 8.21 or later to apply the patch associated with commit 146905a459106b5d00b4f09453a6554255e6965a.
  • If immediate upgrading is not possible, restrict external access to the LDAP sync API by configuring firewall rules or network segmentation so only trusted IPs can reach the endpoint.
  • Ensure that the LDAP sync functionality is only invoked by authorized users; apply additional role‑based access control checks in the syncUser.js module if custom adjustments are required.

Generated by OpenCVE AI on April 18, 2026 at 13:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*

Thu, 05 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 05 Feb 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Wekan Project
Wekan Project wekan
Vendors & Products Wekan Project
Wekan Project wekan

Thu, 05 Feb 2026 01:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls. It is possible to initiate the attack remotely. Upgrading to version 8.21 is able to mitigate this issue. Patch name: 146905a459106b5d00b4f09453a6554255e6965a. You should upgrade the affected component.
Title WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control
Weaknesses CWE-266
CWE-284
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Wekan Project Wekan
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:17:56.116Z

Reserved: 2026-02-04T14:46:30.516Z

Link: CVE-2026-1898

cve-icon Vulnrichment

Updated: 2026-02-05T15:20:53.824Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-05T01:15:53.507

Modified: 2026-02-10T21:46:48.117

Link: CVE-2026-1898

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T13:45:45Z

Weaknesses