CVE-2026-53445

unknowncovered by 1 sourcefirst seen 2026-07-15

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID without checking this.userId, membership, or admin access. Any authenticated user can copy a private board they are not a member of, including its cards, checklists, custom fields, labels, and rules, while the REST POST /api/boards/:boardId/copy path correctly checks board admin access. This issue is fixed in version 9.32.

⚡ Watch CVE-2026-53445

Get an email if CVE-2026-53445 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-53445: Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP m…nvd · 2026-07-15

External references

NVD record for CVE-2026-53445

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-53445 status](https://www.csirts.com/badge/CVE-2026-53445)](https://www.csirts.com/cve/CVE-2026-53445)