Wekan
CVE-2026-53445
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Any authenticated user exploits over the network with no interaction (PR:L, AV:N, AC:L, UI:N); full read of private board content gives C:H, cloning yields minor I:L, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID without checking this.userId, membership, or admin access. Any authenticated user can copy a private board they are not a member of, including its cards, checklists, custom fields, labels, and rules, while the REST POST /api/boards/:boardId/copy path correctly checks board admin access. This issue is fixed in version 9.32.
AnalysisAI
Broken access control in Wekan's open-source kanban server (all releases prior to 9.32) lets any authenticated user copy a private board they have no membership in. The vulnerable copyBoard Meteor DDP method in server/publications/boards.js accepts a caller-supplied board ID without verifying this.userId, membership, or admin rights, so an attacker can exfiltrate the board's cards, checklists, custom fields, labels, and rules into a board they own. No public exploit identified at time of analysis; the flaw is authenticated-only (PR:L) with an EPSS/KEV signal absent from the input.
Technical ContextAI
Wekan is a Meteor-based kanban application that exposes server logic through Meteor DDP methods (real-time RPC over WebSocket) alongside a parallel REST API. The bug is a classic CWE-862 Missing Authorization: the DDP copyBoard method fetched the target board by ID and performed the copy without any authorization gate, while the functionally equivalent REST path POST /api/boards/:boardId/copy correctly enforced board admin access via checkAdminOrCondition. This inconsistency between two code paths implementing the same feature is the root cause - the DDP method trusted the client-supplied board ID and never called board.hasMember(this.userId) or board.hasAdmin(this.userId). The commit diff (8940a10) shows the original code did not even check membership at the vulnerable point and the fix inserts a board.hasAdmin(this.userId) check to match the REST endpoint.
RemediationAI
Vendor-released patch: upgrade to Wekan 9.32 or later, which adds a board.hasAdmin(this.userId) authorization check to the copyBoard DDP method (see release https://github.com/wekan/wekan/releases/tag/v9.32 and advisory https://github.com/wekan/wekan/security/advisories/GHSA-7w2h-g83c-jqrp). If you cannot upgrade immediately, the practical compensating control is to restrict who can hold accounts on the instance - disable open self-registration and prune untrusted users - since exploitation requires an authenticated session; the trade-off is reduced convenience for legitimate onboarding. On instances that expose Wekan to broad user populations, consider temporarily front-loading the DDP endpoint behind network restrictions or taking the copy feature out of reach for untrusted tenants until patched. Verify the fix by confirming server/publications/boards.js contains the hasAdmin check from commit 8940a10.
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today