CVE-2026-53447

Received Received - Intake

Wekan Board Cloning Privilege Escalation

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport() or checking source-board membership. Any authenticated user who knows a private board ID can clone the board into their own account and read its cards, comments, attachments, member information, and activities. This issue is fixed in version 9.35.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-07-16

AI Q&A

2026-07-16

EPSS Evaluated

N/A

NVD

CVE-2026-53447

Affected Vendors & Products

Vendor	Product	Version / Range
wekan	wekan	to 9.35 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Wekan allows any authenticated user to clone a private board by knowing its ID. The cloneBoard method does not verify if the user has permission to access the source board, leading to unauthorized access to sensitive data like cards, comments, attachments, and member information.

Impact Analysis

If you use Wekan with private boards, an attacker could access confidential information by cloning your boards. This could lead to data leaks, unauthorized modifications, or misuse of sensitive project details.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing personal or health-related data stored in private boards. Organizations may face legal penalties for failing to protect sensitive information adequately.

Mitigation Strategies

Update Wekan to version 9.35 or later to address the vulnerability. Ensure only authorized users have access to private board IDs and review board memberships for suspicious activity.

Hi! I’m here to help you understand CVE-2026-53447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70