Authorization Flaw in Wekan Kanban Software by Wekan
CVE-2026-53447
6.5MEDIUM
What is CVE-2026-53447?
An authorization flaw in Wekan, an open-source kanban board tool, has been identified which allows authenticated users to clone private boards without proper checks. This vulnerability occurs in the cloneBoard Meteor method prior to version 9.35, where it utilizes the caller-supplied sourceBoardId to export board data without verifying ownership through canExport(). As a result, any authenticated user with knowledge of a private board ID can gain unauthorized access to board content, including cards, comments, attachments, member information, and activities. This issue has been addressed in version 9.35.
Affected Version(s)
wekan < 9.35