CVE-2026-53447 PUBLISHED

Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID

Assigner: GitHub_M
Reserved: 09.06.2026 Published: 15.07.2026 Updated: 15.07.2026

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport() or checking source-board membership. Any authenticated user who knows a private board ID can clone the board into their own account and read its cards, comments, attachments, member information, and activities. This issue is fixed in version 9.35.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Product Status

Vendor wekan
Product wekan
Versions
  • Version < 9.35 is affected

References

Problem Types

  • CWE-639: Authorization Bypass Through User-Controlled Key CWE
  • CWE-862: Missing Authorization CWE