CVE-2026-68559

Received Received - Intake

Wekan Board Data Exposure via Unawaited Authorization Check

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-68559

EUVD

EUVD-2026-62700

Affected Vendors & Products

Vendor	Product	Version / Range
wekan	wekan	to 9.74 (inc)
wekan	wekan	to 9.74 (exc)
wekan	wekan	9.74

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-68559 is a broken access control vulnerability in Wekan, an open-source Kanban board application. It affects the Excel-export route (/api/boards/:boardId/exportExcel) where an asynchronous authorization check was not properly awaited. This allowed any authenticated user to export private board data even if they were not a member.

Detection Guidance

To detect this vulnerability, check if your Wekan instance is running a version between 9.57 and 9.74. Verify if the /api/boards/:boardId/exportExcel endpoint allows unauthenticated non-members to access private board data. Test by attempting to export a private board with a non-member account and checking if the request succeeds.

Impact Analysis

An attacker with valid credentials but no board access could download sensitive board information including card titles, descriptions, lists, swimlanes, members, and metadata. This exposes confidential project data to unauthorized users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's access controls. It risks exposing personal or health information to unauthorized parties, potentially resulting in compliance breaches.

Mitigation Strategies

Immediately upgrade Wekan to version 9.74 or later to apply the fix. If upgrading is not possible, apply the patch from the GitHub commit 7bbd1a3fad5d868fd01d79b5908913e215698e8e. Ensure all async authorization checks are properly awaited in your codebase.

Hi! I’m here to help you understand CVE-2026-68559. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70