CVE-2026-53447: Wekan Auth Bypass Vulnerability

CVE-2026-53447 Overview

CVE-2026-53447 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Wekan, an open source kanban application built with Meteor. The flaw resides in the cloneBoard Meteor method inside models/import.js, which accepts a caller-supplied sourceBoardId and builds a board export through models/exporter.js. The method fails to invoke canExport() and does not verify source-board membership. Any authenticated user who knows or guesses a private board ID can clone that board into their own account. Cloning exposes cards, comments, attachments, member information, and activities. The issue is fixed in Wekan version 9.35.

Critical Impact
Authenticated users can clone arbitrary private Wekan boards by ID, reading all cards, comments, attachments, and member data without authorization.

Affected Products

Wekan open source kanban prior to version 9.35
Meteor-based Wekan deployments using models/import.jscloneBoard
Self-hosted Wekan instances exposing authenticated user accounts

Discovery Timeline

2026-07-15 - CVE-2026-53447 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-53447

Vulnerability Analysis

The cloneBoard Meteor method exposes an IDOR pattern common to server-side object handlers. The method trusts the sourceBoardId passed by the client and immediately invokes the exporter to serialize the entire board. Because canExport() is never called and the caller's membership on the source board is not validated, authorization is effectively skipped. The result is a full clone of the target board under the attacker's ownership, granting persistent read access to previously private data. Adjacent code paths, such as the attachment API, exhibited similar spoofable-parameter issues that the same release corrects. The fix is tracked in the GitHub advisory GHSA-qfqv-42qw-vvwh.

Root Cause

The root cause is missing access control on a privileged export path. cloneBoard receives sourceBoardId from an untrusted caller and does not confirm that the caller belongs to that board or holds export rights. This matches [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

An authenticated attacker sends a Meteor method call to cloneBoard with the target's private board ID. The server exports and imports the board into the attacker's account. Board IDs are opaque but enumerable, and disclosed IDs from screenshots, logs, or referrals accelerate exploitation.

javascript

// Patch excerpt: models/import.js (v9.35)
 import { Meteor } from 'meteor/meteor';
+import { ReactiveCache } from '/imports/reactiveCache';
 import { TrelloCreator } from './trelloCreator';
 import { WekanCreator } from './wekanCreator';
 import { CsvCreator } from './csvCreator';

// Related patch: server/attachmentApi.js
         throw new Meteor.Error('board-not-found', 'Board not found');
       }

+      // The card must actually belong to the board the caller named, otherwise
+      // boardId could be spoofed to a board the caller is a member of while the
+      // attachment is attached to a card on a different board.
+      if (card.boardId !== boardId) {
+        throw new Meteor.Error('invalid-parameters', 'Card does not belong to this board');
+      }

       // Check permissions
-      if (!board.isBoardMember(this.userId)) {
+      if (!board.hasMember(this.userId)) {
         throw new Meteor.Error('not-authorized', 'You do not have permission to modify this card');
       }
// Source: https://github.com/wekan/wekan/commit/357de728c03113b787065bac2c5832ad77f1a117

Detection Methods for CVE-2026-53447

Indicators of Compromise

Unexpected new board copies in user accounts whose owners are not members of the corresponding source boards.
Meteor method logs showing cloneBoard calls where sourceBoardId does not match any board the caller belongs to.
Spikes in export or import activity from a single authenticated account within a short window.

Detection Strategies

Audit the Wekan MongoDB boards collection for cloned board titles or duplicate structures across unrelated users.
Enable Meteor method call logging and alert on cloneBoard invocations that fail a post-hoc membership check against the supplied sourceBoardId.
Correlate authentication events with newly created boards to identify accounts cloning content en masse.

Monitoring Recommendations

Ship Wekan application and web server logs to a central analytics platform and retain Meteor method telemetry.
Track counts of board creations per user and alert on statistical outliers.
Monitor outbound egress from the Wekan host for bulk attachment downloads following a clone event.

How to Mitigate CVE-2026-53447

Immediate Actions Required

Upgrade Wekan to version 9.35 or later without delay.
Rotate any secrets, API tokens, or credentials that may have been stored in board cards, comments, or attachments.
Review board membership lists and remove stale or unknown user accounts.

Patch Information

The fix ships in Wekan 9.35, published in the GitHub Release v9.35. The corrective changes are captured in commit 357de72, which enforces canExport() and validates that the caller is a member of the referenced board before cloning. Refer to the GitHub Security Advisory GHSA-qfqv-42qw-vvwh for the full advisory record.

Workarounds

Restrict Wekan account creation to trusted users and disable self-registration until the upgrade is complete.
Place Wekan behind an authenticating reverse proxy and rate-limit Meteor method traffic.
Temporarily disable board import and clone features via administrative configuration where feasible.

bash

# Upgrade Wekan container to the patched release
docker pull quay.io/wekan/wekan:v9.35
docker stop wekan-app && docker rm wekan-app
docker run -d --name wekan-app \
  --env-file /opt/wekan/wekan.env \
  -p 8080:8080 \
  quay.io/wekan/wekan:v9.35

# Verify the running version
docker exec wekan-app node -e "console.log(require('/build/programs/server/assets/packages/meteor.js'))" | grep -i version