Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-53447Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in wekan from wekan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport() or checking source-board membership. Any authenticated user who knows a private board ID can clone the board into their own account and read its cards, comments, attachments, member information, and activities. This issue is fixed in version 9.35.

Affected products (as reported)

Vendor	Product	Versions
wekan	wekan	< 9.35

Weakness: CWE-639, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/wekan/wekan/security/advisories/GHSA-qfqv-42qw-vvwh x_refsource_CONFIRM
https://github.com/wekan/wekan/commit/357de728c03113b787065bac2c5832ad77f1a117 x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.35 x_refsource_MISC