CVE-2026-53447 | Wekan is open source kanban built with Meteor. Prior to 9.35… | CVSS 6.5 MEDIUM

Description

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport() or checking source-board membership. Any authenticated user who knows a private board ID can clone the board into their own account and read its cards, comments, attachments, member information, and activities. This issue is fixed in version 9.35.

Metadata

CVE ID: CVE-2026-53447
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-09 16:31 UTC
Published: 2026-07-15 21:12 UTC
Last updated: 2026-07-16 18:48 UTC
Primary CWE: CWE-639
CWE-639: Authorization Bypass Through User-Controlled Key
Vendor / Product: wekan / wekan
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
wekan	wekan	—	< 9.35

Weakness (CWE)

CWE	Source	Description
CWE-639	cna	CWE-639: Authorization Bypass Through User-Controlled Key
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (3)

https://github.com/wekan/wekan/security/advisories/GHSA-qfqv-42qw-vvwh https://github.com/wekan/wekan/security/advisories/GHSA-qfqv-42qw-vvwh
https://github.com/wekan/wekan/commit/357de728c03113b787065bac2c5832ad77f1a117 https://github.com/wekan/wekan/commit/357de728c03113b787065bac2c5832ad77f1a117
https://github.com/wekan/wekan/releases/tag/v9.35 https://github.com/wekan/wekan/releases/tag/v9.35