CVE-2026-53445highCWE-862

CVE-2026-53445: falha de alta gravidade em wekan

Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WeKan

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.4%
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID without checking this.userId, membership, or admin access. Any authenticated user can copy a private board they are not a member of, including its cards, checklists, custom fields, labels, and rules, while the REST POST /api/boards/:boardId/copy path correctly checks board admin access. This issue is fixed in version 9.32.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
wekan · wekan
CVEs relacionadas — wekan

No mesmo produto, das mais perigosas para as menos.

CVE-2026-52891CRITICALWekan: Shell Injection via Avatar UploadEPSS 0.8%CVE-2026-55652CRITICALWekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)EPSS 0.6%CVE-2026-68560HIGHWekan:hell Injection in External Antivirus Scanner Path via asyncExecEPSS 0.6%CVE-2026-68901MEDIUMWeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of ServiceEPSS 0.5%CVE-2026-68899HIGHWekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary FallbackEPSS 0.5%CVE-2026-68561HIGHWekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow ruleEPSS 0.5%