CVE-2026-53445: Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID without checking this.userId, membership, or admin access. Any authenticated user can copy a private board they are not a member of, including its cards, checklists, custom fields, labels, and rules, while the REST POST /api/boards/:boardId/copy path correctly checks board admin access. This issue is fixed in version 9.32.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wekanto a version that resolves this vulnerability.Fixed in 9.32
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53445?
CVE-2026-53445 has a severity rating of high, with a CVSS score of 7.1.
How do I fix CVE-2026-53445?
To fix CVE-2026-53445, upgrade Wekan to version 9.32 or later.
What does CVE-2026-53445 involve?
CVE-2026-53445 involves an authorization bypass in the copyBoard method, allowing any authenticated user to copy private boards without permission.
Which software is affected by CVE-2026-53445?
CVE-2026-53445 affects the Wekan open-source kanban software.
When was CVE-2026-53445 published?
CVE-2026-53445 was published on July 15, 2026.