The vulnerability originates from the Wekan copyBoard Meteor DDP method in server/publications/boards.js, which copies a board based on a caller‑supplied board ID without checking this.userId, membership, or administrative privilege. As a result, any authenticated user may copy a private board they are not a member of, including all associated data such as cards, checklists, custom fields, labels, and rules. The REST POST /api/boards/:boardId/copy endpoint correctly enforces admin access, but the DDP method bypasses this protection. The issue is resolved in version 9.32.

The vulnerability affects all installations of the Wekan project running a version older than v9.32. Only the wekan:wekan product is impacted; any deployment that runs an earlier release and exposes the copyBoard DDP endpoint is susceptible.

The vulnerability carries a CVSS score of 7.1, indicating high severity, while the EPSS score is below 1%, suggesting a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Attackers must first authenticate to the system; once authenticated, they can supply any private board ID to the copyBoard DDP endpoint to create a copy with full data leakage. The lack of permission checks makes the exploitation straightforward for legitimate users who are not board members.