CVE-2026-68559
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Wekan from 9.57 until 9.74 contains a vulnerability in the /api/boards/:boardId/exportExcel route where the authorization guard exporterExcel.canExport(user) is not awaited. The returned Promise is always truthy, so exporterExcel.build(res) runs even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board data. Fixed in version 9.74.
Risk Assessment
Unauthorized users can access private board data, potentially leading to leakage of sensitive information.
Recommendation
Upgrade Wekan to version 9.74 or later to fix the authorization issue.
Original NVD description (English source)
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.