CVE-2026-53447 Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID
Any authenticated user can clone and read private boards by ID due to missing authorization checks in the cloneBoard method.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53447?
CVE-2026-53447 is a medium-severity missing authorization vulnerability in wekan, published on 15 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport() or checking source-board membership. Any authenticated user who knows a private board ID can clone the board into their own account and read its cards, comments, attachments, member information, and activities. This issue is fixed in version 9.35.
Which versions are affected by CVE-2026-53447?
How do I fix CVE-2026-53447?
No fix has been published for CVE-2026-53447 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-53447 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53447 exists.
Sources
Also known as GHSA-qfqv-42qw-vvwh.