Wekan Cloning Vulnerability in `cloneBoard` Method Allows Unauthorized Access to Private Boards

A vulnerability in the Wekan `cloneBoard` Meteor method, present in versions prior to 9.35, allows any authenticated user to clone private boards into their own account without authorization. The method uses a caller-supplied board ID to export the entire board, including cards, comments, attachments, member information, and activities, without checking if the user is allowed to access the board. This issue has been addressed in version 9.35.

Impact

Exploitation of this vulnerability leads to unauthorized access to the contents of private boards, including sensitive information such as comments, attachments, and member details.

Reproduction

To reproduce this vulnerability, an authenticated user can call the `cloneBoard` method over DDP, using the ID of a private board they are not a member of. This can be done through the browser console by running `Meteor.call('cloneBoard', '<privateBoardId>')`.

Remediation

Users can update to Wekan version 9.35 or later, where this vulnerability has been fixed.