# CVE-2026-53447: Wekan missing authorization in cloneBoard method

Source: https://junglewise.ai/threats/cve-2026-53447-wekan-missing-authorization-in-cloneboard-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-53447 · Severity: medium · CVSS 6.5 · Published 2026-07-15

Wekan is an open-source Kanban board application used for project management and collaboration. A security flaw in the board cloning feature allows any logged-in user to copy and read the contents of private boards they do not have permission to access, provided they know the board's ID. This could lead to the unauthorized exposure of sensitive project data, including cards, comments, attachments, and member information.

Technologies: [WeKan](https://junglewise.ai/threats/technologies/wekan). Vendors: [WeKan](https://junglewise.ai/threats/vendors/wekan).

## Quick answers

**Is CVE-2026-53447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53447 being exploited in the wild.

**How severe is CVE-2026-53447?** Medium severity, with a CVSS score of 6.5, published 15 July 2026.

**Which products and versions are affected?** WeKan < 9.35.

**Is there a fix for CVE-2026-53447?** A patch was published on 2026-06-05: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53447 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53447?** Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'cloneBoard' Meteor method in 'models/import.js' fails to perform authorization checks before processing a request. It uses a caller-supplied 'sourceBoardId' to build a full board export via 'models/exporter.js' without invoking the 'canExport()' guard or verifying board membership. An authenticated attacker who knows a private board ID (which may be visible in URLs or known from previous membership) can invoke this method via DDP to clone the board into their own account. This grants the attacker full access to cards, comments, attachments, and activity logs. The issue is resolved in version 9.35 by enforcing 'canExport' checks within the cloning logic.

## Affected products

- Wekan Wekan < 9.35

## Timeline

- 2026-06-05: patched: Fix committed to repository
- 2026-06-06: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD

## References

- [https://github.com/wekan/wekan/commit/357de728c03113b787065bac2c5832ad77f1a117](https://github.com/wekan/wekan/commit/357de728c03113b787065bac2c5832ad77f1a117)
- [https://github.com/wekan/wekan/releases/tag/v9.35](https://github.com/wekan/wekan/releases/tag/v9.35)
- [https://github.com/wekan/wekan/security/advisories/GHSA-qfqv-42qw-vvwh](https://github.com/wekan/wekan/security/advisories/GHSA-qfqv-42qw-vvwh)

## Related threats

- [Wekan ReDoS in user search via unescaped regex](https://junglewise.ai/threats/cve-2026-119300-wekan-is-open-source-kanban-built-with-meteor-prior-to-11-11-the)
- [Wekan authentication bypass via X-Forwarded-For spoofing in header-login](https://junglewise.ai/threats/cve-2026-55652-wekan-authentication-bypass-via-x-forwarded-for-spoofing-in)
- [Wekan broken access control in DDP update rules](https://junglewise.ai/threats/cve-2026-55234-wekan-broken-access-control-in-ddp-update-rules)
- [Wekan SSRF in webhook integration URLs](https://junglewise.ai/threats/cve-2026-53446-wekan-ssrf-in-webhook-integration-urls)
- [Wekan missing authorization in copyBoard DDP method](https://junglewise.ai/threats/cve-2026-53445-wekan-missing-authorization-in-copyboard-ddp-method)