CVE-2026-2209 WeKan Custom Translation translationBody.js setCreateTranslation improper authorization

What is CVE-2026-2209?

CVE-2026-2209 is a medium-severity vulnerability in WeKan, published on 8 Feb 2026.

Official description

A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationBody.js of the component Custom Translation Handler. The manipulation results in improper authorization. The attack can be launched remotely. Upgrading to version 8.19 is sufficient to fix this issue. The patch is identified as f244a43771f6ebf40218b83b9f46dba6b940d7de. It is suggested to upgrade the affected component.

Weakness: CWE-285, CWE-266

Which versions are affected by CVE-2026-2209?

It affects 1 product.

Products include Wekan Project Wekan.

How do I fix CVE-2026-2209?

No fix has been published for CVE-2026-2209 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-2209 being exploited?

There is no known exploitation of CVE-2026-2209 in the wild and no public exploit code.

Other vulnerabilities in WeKan

• CVE-2026-30843 Wekan has Cross-Board IDOR in Custom Fields Update Endpoints Critical 9.3
• CVE-2026-30844 Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading Critical 9.3
• CVE-2026-30847 Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens Critical 9.3
• CVE-2025-65780 Missing authorization in n/a High 8.8
• CVE-2026-30846 Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2hfm-wh8p-mfqm.