CVE-2026-68901

Received Received - Intake

TypeError in Wekan Export Handlers Due to Unchecked User Token

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlled authToken query parameter and immediately called user._id.toString() without checking whether ReactiveCache.getUser() returned undefined. A request for a private board with an unknown token therefore threw a TypeError from an asynchronous route, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard after every export token lookup and wraps export handlers with safeRoute() so unexpected exceptions become controlled responses. This issue is fixed in version 10.38.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-68901

EUVD

EUVD-2026-62714

Affected Vendors & Products

Vendor	Product	Version / Range
wekan	wekan	10.38
wekan	wekan	10.37

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

CVE-2026-68901 is a vulnerability in Wekan, an open-source kanban application. It involves improper handling of invalid authentication tokens in board export endpoints. When an attacker provides an invalid token, the application crashes due to a TypeError from dereferencing an undefined user object. This leads to an unhandled promise rejection that terminates the Wekan process, causing a denial of service for all users.

Detection Guidance

To detect this vulnerability, monitor for crashes in the Wekan application when accessing board export endpoints with invalid auth tokens. Check logs for TypeError exceptions related to user._id.toString() in /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, or /api/boards/:boardId/exportExcel.

Impact Analysis

This vulnerability allows an attacker to crash the Wekan server by sending a request with an invalid authToken to specific export endpoints. This results in a complete service outage, denying access to all users. The impact is higher on open-registration instances where attackers can create accounts and trigger the crash.

Mitigation Strategies

Upgrade Wekan to version 10.38 or later to apply the fix. If upgrading is not immediately possible, restrict access to export endpoints or implement null checks in the affected handlers as a temporary workaround.

Hi! I’m here to help you understand CVE-2026-68901. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70