CVE-2026-2209

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in improper authorization. The attack can be launched remotely. Upgrading to version 8.19 is sufficient to fix this issue. The patch is identified as f244a43771f6ebf40218b83b9f46dba6b940d7de. It is suggested to upgrade the affected component.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-266 CWE-285

Affected software

Vendor	Product	Versions
n/a	WeKan	8.0; 8.1; 8.2; 8.3; 8.4; 8.5; 8.6; 8.7; 8.8; 8.9; 8.10; 8.11; 8.12; 8.13; 8.14; 8.15; 8.16; 8.17; 8.18

References

https://github.com/wekan/wekan/Product
https://github.com/wekan/wekan/commit/f244a43771f6ebf40218b83b9f46dba6b940d7dePatch
https://github.com/wekan/wekan/releases/tag/v8.19Product, Release Notes
https://vuldb.com/?ctiid.344923Permissions Required, VDB Entry
https://vuldb.com/?id.344923Third Party Advisory, VDB Entry
https://vuldb.com/?submit.752269Third Party Advisory, VDB Entry

Timeline

Published: Feb 8, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-220939.5The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This a CVE-2026-220949.3The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is ex CVE-2026-220959.3The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.CVE-2026-220969.3The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwor CVE-2026-220979.3The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update cap CVE-2026-220989.2Various sensitive information such as passwords and charging card UIDs are written to log files.CVE-2026-220998.7The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive CVE-2026-22107.2A vulnerability has been found in D-Link DIR-823X 250416. This affects the function sub_4211C8 of the file /goform/set_filtering. Such manip CVE-2026-221008.6The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can b CVE-2026-221015.1The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial CVE-2026-221029.3A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename par CVE-2026-221039.3The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.