Wekan
CVE-2026-53447
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable Meteor method requires only a valid login (PR:L); board ID is the sole gate with no technical complexity (AC:L), and only board data is read with no write or service impact (C:H, I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport() or checking source-board membership. Any authenticated user who knows a private board ID can clone the board into their own account and read its cards, comments, attachments, member information, and activities. This issue is fixed in version 9.35.
AnalysisAI
Unauthorized full-board read access in Wekan prior to v9.35 allows any authenticated user to exfiltrate the entire contents of any private board - cards, comments, attachments, member lists, and activity logs - by calling the cloneBoard Meteor method with an arbitrary board ID. The root cause is that models/import.js invokes the board exporter directly without calling canExport() or verifying source-board membership, the same guard correctly applied by the REST export route. No public exploit code has been identified at time of analysis, but the attack requires only a valid account and knowledge of a target board's ID, making it trivially reproducible by any developer familiar with the Meteor DDP protocol.
Technical ContextAI
Wekan is a Meteor-based open-source kanban platform backed by MongoDB. The cloneBoard server-side Meteor method in models/import.js accepts a caller-supplied sourceBoardId, passes it directly to models/exporter.js to build a full board export, and then writes the result into the caller's account. Prior to v9.35, the method omitted the canExport() authorization gate - which internally calls board.isVisibleBy(user) to verify board membership - that the REST-based /api/boards/:id/export route correctly enforces. CWE-639 (Authorization Bypass Through User-Controlled Key) precisely describes the root cause: the method blindly trusts a caller-controlled identifier to scope a privileged data operation without independently verifying the caller's access rights. The commit diff (357de728) also reveals a secondary pattern: several attachment API methods used isBoardMember() instead of the authoritative hasMember(), indicating a broader inconsistency in membership-check coverage across the codebase that was corrected in the same release.
RemediationAI
Vendor-released patch: Wekan v9.35. Upgrade to v9.35 or later immediately; the release is available at https://github.com/wekan/wekan/releases/tag/v9.35 and the exact fix is in commit 357de728c03113b787065bac2c5832ad77f1a117. If an immediate upgrade is not feasible, restrict the Wekan instance to a private network or VPN so that only fully trusted users can authenticate - this reduces but does not eliminate insider risk, since any valid account on the instance can trigger the flaw. Do not rely on 'private board' access controls as a compensating control, as those controls are precisely what this vulnerability bypasses. Note that network-level restriction does not protect against malicious or compromised insiders; patching remains the only complete remediation.
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker imperson
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today