CVE-2026-53445: Wekan Auth Bypass Vulnerability

CVE-2026-53445 Overview

CVE-2026-53445 is an authorization bypass vulnerability in Wekan, an open source kanban board built on Meteor. The flaw resides in the copyBoard Meteor Distributed Data Protocol (DDP) method within server/publications/boards.js. The method copies a board using a caller-supplied board ID without verifying this.userId, board membership, or admin access. Any authenticated user can duplicate a private board they do not belong to, including its cards, checklists, custom fields, labels, and rules. The parallel REST endpoint POST /api/boards/:boardId/copy correctly enforces board admin access, exposing the gap in the DDP path. The issue is fixed in Wekan version 9.32 and is tracked as [CWE-862] Missing Authorization.

Critical Impact
Authenticated users can exfiltrate the full contents of private boards they should not access, breaking tenant isolation between workspaces.

Affected Products

Wekan versions prior to 9.32
Wekan self-hosted Meteor deployments exposing DDP
Wekan multi-tenant instances hosting private boards

Discovery Timeline

2026-07-15 - CVE-2026-53445 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-53445

Vulnerability Analysis

Wekan exposes board operations through two parallel interfaces: a REST API and Meteor's DDP protocol. The REST endpoint POST /api/boards/:boardId/copy calls checkAdminOrCondition with adminAccess, ensuring only board admins can duplicate a board. The corresponding DDP method copyBoard omitted equivalent authorization checks entirely. An authenticated user could invoke the DDP method directly, supply any known or guessed board ID, and receive a full copy of that board in their own workspace. The copy carries over cards, checklists, custom fields, labels, and rules, resulting in complete disclosure of sensitive project data.

Root Cause

The root cause is missing authorization enforcement [CWE-862] on a server-side Meteor method. The copyBoard DDP handler did not validate that the calling user was a board member, let alone an admin. Authorization logic was duplicated across REST and DDP surfaces, and the DDP variant drifted out of parity with the REST variant. This is a classic case of inconsistent access control across parallel interfaces.

Attack Vector

Exploitation requires only a valid, low-privileged Wekan account and network reachability to the Meteor server. The attacker opens a DDP connection, calls the copyBoard method, and passes a target boardId. The server executes the copy without checking membership. Board IDs are enumerable or discoverable through indirect exposure, making the attack straightforward against multi-tenant Wekan installations.

javascript

// Patch applied in server/publications/boards.js (Wekan v9.32)
     if (!this.userId) throw new Meteor.Error('not-authorized');
     const board = await ReactiveCache.getBoard(boardId);
     if (!board) throw new Meteor.Error('not-found');
-    if (!board.hasMember(this.userId)) throw new Meteor.Error('not-authorized');
+    // Require board admin, matching the REST endpoint
+    // POST /api/boards/:boardId/copy (checkAdminOrCondition with adminAccess).
+    if (!board.hasAdmin(this.userId)) throw new Meteor.Error('not-authorized');
 
     // Strip fields the caller must not control on the copy
     const { members, permission, ...safeProperties } = properties;

Source: Wekan security patch commit 8940a103

Detection Methods for CVE-2026-53445

Indicators of Compromise

Unexpected board duplicates in user workspaces referencing boardId values from other tenants or private projects.
DDP method calls to copyBoard originating from accounts that are not admins of the referenced board.
Sudden growth in the boards collection with copied or cloned-source metadata pointing to boards outside the caller's membership.

Detection Strategies

Audit MongoDB boards collection for entries whose source board owner differs from the copy owner and where the copy owner lacks membership on the source.
Enable Meteor method-call logging and alert on copyBoard invocations that do not correlate with a preceding admin-authenticated REST session.
Correlate application logs with reverse-proxy access logs to identify DDP traffic that bypasses the REST endpoints.

Monitoring Recommendations

Instrument the Wekan server to log this.userId, boardId, and authorization outcome for every DDP method invocation.
Forward Wekan and reverse-proxy logs to a centralized SIEM and alert on anomalous copy-operation volume per user.
Baseline normal board-copy activity per user and flag deviations exceeding that baseline.

How to Mitigate CVE-2026-53445

Immediate Actions Required

Upgrade Wekan to version 9.32 or later, which enforces board.hasAdmin(this.userId) in the copyBoard DDP method.
Inventory existing boards for unauthorized duplicates created before the patch was applied.
Rotate any secrets, API tokens, or sensitive attachments that may have been exposed through copied boards.

Patch Information

The fix is available in Wekan Release v9.32 and documented in GitHub Security Advisory GHSA-7w2h-g83c-jqrp. The patch aligns the DDP copyBoard method with the REST endpoint by requiring board admin access before performing the copy. Review the commit 8940a103 for the exact code change.

Workarounds

If immediate upgrade is not possible, restrict Wekan to trusted authenticated users only and disable open registration.
Place Wekan behind a reverse proxy that inspects and rate-limits DDP WebSocket traffic to reduce enumeration risk.
Temporarily monkey-patch the copyBoard method in a local fork to add the board.hasAdmin(this.userId) check until the official upgrade is deployed.

bash

# Verify the running Wekan version and upgrade via Docker
docker inspect wekan --format '{{.Config.Image}}'
docker pull wekanteam/wekan:v9.32
docker stop wekan && docker rm wekan
docker run -d --name wekan --env-file wekan.env -p 8080:8080 wekanteam/wekan:v9.32