CyberRota Analysis
AI-GeneratedWekan versions prior to 9.32 are vulnerable to unauthorized board copying, allowing any authenticated user to duplicate private boards they do not belong to, along with all associated content. This flaw poses a significant risk to data privacy and integrity, as sensitive information can be accessed and replicated without proper authorization. Organizations using Wekan should prioritize upgrading to version 9.32 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-supplied board ID without checking this.userId, membership, or admin access. Any authenticated user can copy a private board they are not a member of, including its cards, checklists, custom fields, labels, and rules, while the REST POST /api/boards/:boardId/copy path correctly checks board admin access. This issue is fixed in version 9.32.