PT-2026-60323 · Wekan · Wekan

Published 2026-07-15 · Updated 2026-07-16 · CVE-2026-53447

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.35

Description The cloneBoard Meteor method in models/import.js fails to invoke the canExport() function or verify membership of the source board when using the sourceBoardId variable. This allows an authenticated user who possesses a private board ID to clone that board into their own account, granting unauthorized access to cards, comments, attachments, member information, and activities.

Recommendations Update to version 9.35.

Fix

IDOR

Missing Authorization

Weakness Enumeration

CWE-639

CWE-862

Related Identifiers

CVE-2026-53447

Affected Products

Wekan

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-53447 · Security Note
• https://github.com/wekan/wekan/security/advisories/GHSA-qfqv-42qw-vvwh · Note
• https://github.com/wekan/wekan/releases/tag/v9.35 · Note
• https://github.com/wekan/wekan/commit/357de728c03113b787065bac2c5832ad77f1a117 · Note
• https://twitter.com/VulmonFeeds/status/2077551959066730912 · Twitter Post