Is CVE-2026-53447 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53447 being exploited in the wild.

How severe is CVE-2026-53447?

Medium severity, with a CVSS score of 6.5, published 15 July 2026.

Is there a fix for CVE-2026-53447?

A patch was published on 2026-06-05: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53447 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-53447?

Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53447: Wekan missing authorization in cloneBoard method

CVE-2026-53447 · Severity: medium · CVSS 6.5 · Published 2026-07-15

Wekan is an open-source Kanban board application used for project management and collaboration. A security flaw in the board cloning feature allows any logged-in user to copy and read the contents of private boards they do not have permission to access, provided they know the board's ID. This could lead to the unauthorized exposure of sensitive project data, including cards, comments, attachments, and member information.

Technologies: WeKan. Vendors: WeKan.

Quick answers

Is CVE-2026-53447 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53447 being exploited in the wild.
How severe is CVE-2026-53447?: Medium severity, with a CVSS score of 6.5, published 15 July 2026.
Which products and versions are affected?: WeKan < 9.35.
Is there a fix for CVE-2026-53447?: A patch was published on 2026-06-05: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53447 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-53447?: Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 'cloneBoard' Meteor method in 'models/import.js' fails to perform authorization checks before processing a request. It uses a caller-supplied 'sourceBoardId' to build a full board export via 'models/exporter.js' without invoking the 'canExport()' guard or verifying board membership. An authenticated attacker who knows a private board ID (which may be visible in URLs or known from previous membership) can invoke this method via DDP to clone the board into their own account. This grants the attacker full access to cards, comments, attachments, and activity logs. The issue is resolved in version 9.35 by enforcing 'canExport' checks within the cloning logic.

Affected products

Wekan Wekan < 9.35

Timeline

2026-06-05: patched: Fix committed to repository
2026-06-06: advisory: GitHub Security Advisory published
2026-07-15: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.