Executive brief
Wekan is an open-source Kanban board application used for project management and collaboration. A security flaw in the board cloning feature allows any logged-in user to copy and read the contents of private boards they do not have permission to access, provided they know the board's ID. This could lead to the unauthorized exposure of sensitive project data, including cards, comments, attachments, and member information.
Technical details
The 'cloneBoard' Meteor method in 'models/import.js' fails to perform authorization checks before processing a request. It uses a caller-supplied 'sourceBoardId' to build a full board export via 'models/exporter.js' without invoking the 'canExport()' guard or verifying board membership. An authenticated attacker who knows a private board ID (which may be visible in URLs or known from previous membership) can invoke this method via DDP to clone the board into their own account. This grants the attacker full access to cards, comments, attachments, and activity logs. The issue is resolved in version 9.35 by enforcing 'canExport' checks within the cloning logic.
Affected products
- Wekan Wekan < 9.35
Timeline
- 2026-06-05: patched: Fix committed to repository
- 2026-06-06: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD