Medium severity · published Jul 15, 2026
CVE-2026-53447
Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport() or checking source-board membership. Any authenticated user who knows a private board ID can clone the board into their own account and read its cards, comments, attachments, member information, and activities. This issue is fixed in version 9.35.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
wekan · wekan
< 9.35 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53447
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53447
github.com
https://github.com/wekan/wekan/commit/357de728c03113b787065bac2c5832ad77f1a117
github.com
https://github.com/wekan/wekan/releases/tag/v9.35
github.com
https://github.com/wekan/wekan/security/advisories/GHSA-qfqv-42qw-vvwh
More from wekan
9.9
CVE-2026-52891
Wekan: Shell Injection via Avatar Upload
9.8
CVE-2026-55652
Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)
9.8
CVE-2026-25560
WeKan < 8.19 LDAP Authentication Filter Injection
9.2
CVE-2026-52893
Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
8.8
CVE-2026-68561
Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule