Technical impact
Wekan is an open‑source kanban platform built with Meteor. Prior to version 9.35, the cloneBoard Meteor method in models/import.js leverages a caller‑supplied sourceBoardId to construct a board export via models/exporter.js, but it neither invokes canExport() nor verifies that the source board belongs to the calling user. Consequently, any authenticated user who knows the ID of a private board can invoke cloneBoard to copy that board into their own account and read all its cards, comments, attachments, member information, and activities. This flaw permits disclosure of private board data that should remain hidden. The vulnerability is fixed by upgrading to version 9.35.
Affected Systems
The affected product is the Wekan open‑source kanban application. All instances of Wekan that are running a version earlier than 9.35 are vulnerable. Upgrade to v9.35 or later removes the flaw.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity, but the EPSS score of less than 1 percent shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to be authenticated to the Wekan instance and to know the private board’s ID; once satisfied, the cloneBoard method can be invoked to copy the entire board into the user’s own account, enabling full read access to the board’s contents.
