CVE-2026-2209

low-risk
Published 2026-02-08

A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in improper authorization. The attack can be launched remotely. Upgrading to version 8.19 is sufficient to fix this issue. The patch is identified as f244a43771f6ebf40218b83b9f46dba6b940d7de. It is suggested to upgrade the affected component.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Wekan Project

References (6)

Product https://github.com/wekan/wekan/
Patch https://github.com/wekan/wekan/commit/f244a43771f6ebf40218b83b9f46dba6b940d7de
Product https://github.com/wekan/wekan/releases/tag/v8.19
Permissions Required https://vuldb.com/?ctiid.344923
Third Party Advisory https://vuldb.com/?id.344923
Third Party Advisory https://vuldb.com/?submit.752269
28
/ 100
low-risk
Severity 23/34 · High
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal