CVE-2026-53447: Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID
Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport() or checking source-board membership. Any authenticated user who knows a private board ID can clone the board into their own account and read its cards, comments, attachments, member information, and activities. This issue is fixed in version 9.35.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wekanto a version that resolves this vulnerability.Fixed in 9.35
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53447?
The severity of CVE-2026-53447 is medium, rated at 6.5.
How do I fix CVE-2026-53447?
To fix CVE-2026-53447, update Wekan to version 9.35 or later.
What is the risk associated with CVE-2026-53447?
CVE-2026-53447 poses a risk of unauthorized access, allowing any authenticated user to clone private boards.
What type of vulnerability is CVE-2026-53447?
CVE-2026-53447 is an authorization bypass vulnerability affecting the cloneBoard method in Wekan.
Who is affected by CVE-2026-53447?
Any user with an authenticated account on Wekan before version 9.35 is potentially affected by CVE-2026-53447.