A vulnerability identified as critical has been detected in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User Sync. This manipulation causes improper access controls.
The identification of this vulnerability is CVE-2026-1898. It is possible to initiate the attack remotely. There is no exploit available.
You should upgrade the affected component.
