CVE-2026-53445 Details
Description
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID without checking this.userId, membership, or admin access. Any authenticated user can copy a private board they are not a member of, including its cards, checklists, custom fields, labels, and rules, while the REST POST /api/boards/:boardId/copy path correctly checks board admin access. This issue is fixed in version 9.32.
An authorization bypass vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This issue affects versions of Wekan prior to 9.32. The vulnerability arises in the 'copyBoard' Meteor DDP method, located in 'server/publications/boards.js'. The method allows any authenticated user to copy a board by providing a board ID, without verifying user ID, membership, or admin status. As a result, users can duplicate private boards they do not belong to, including all associated cards, checklists, custom fields, labels, and rules. In contrast, the equivalent REST API endpoint correctly enforces admin access requirements.
Users can upgrade to Wekan version 9.32 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wekan/wekan/security/advisories/GHSA-7w2h-g83c-jqrp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/wekan/wekan/commit/8940a103970c5da3f02b3615eef09fabfff421e3 | [email protected] | Source CodeVendor |
| https://github.com/wekan/wekan/releases/tag/v9.32 | [email protected] | Release NotesVendor |
| https://github.com/wekan/wekan/security/advisories/GHSA-7w2h-g83c-jqrp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Wekan | <= 9.08 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |