CVE-2026-68559 in Wekan
Summary
by MITRE • 08/20/2026
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Wekan versions ranging from 9.57 through 9.74 represents a critical authorization bypass rooted in improper asynchronous handling within the application's backend logic. Specifically, the flaw resides in the /api/boards/:boardId/exportExcel endpoint, which is responsible for generating Excel exports of board data. The core technical defect occurs when the system invokes the async function exporterExcel.canExport(user) to verify if a user has permission to export data from a specific board. Because this asynchronous call was not awaited, the JavaScript engine did not pause execution to wait for the Promise returned by canExport to resolve or reject. Instead, it proceeded immediately with the next line of code, which calls exporterExcel.build(res).
In JavaScript, any resolved Promise object is considered truthy in a boolean context. Consequently, even if the underlying authorization logic determined that the user lacked permission—such as when board.isVisibleBy(user) would return false—the condition checking the result of canExport remained true due to the unresolved or pending nature of the Promise at the time of evaluation. This logical error effectively neutralized the access control mechanism for this specific route, allowing any authenticated user who was not a member of the private board to trigger the export functionality and retrieve sensitive information.
The operational impact of this vulnerability is significant as it leads to unauthorized data disclosure. An attacker with valid credentials can exploit this flaw to download comprehensive details from private boards they do not belong to. The exported Excel file contains card titles, descriptions, lists, swimlanes, member identities, and various metadata fields. This exposure violates the principle of least privilege and compromises the confidentiality of sensitive project management data that organizations rely on for secure collaboration. Such information leakage can facilitate further social engineering attacks or provide adversaries with insights into internal workflows and personnel structures.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to enforce proper restrictions on authenticated users regarding specific resources. It also maps to MITRE ATT&CK technique T1530 Data from Cloud Storage Object or Internal Repository, specifically under the context of unauthorized access to stored data via API exploitation. The root cause is a classic asynchronous programming error where control flow does not respect the completion state of an async operation, leading to security checks being bypassed entirely.
To mitigate this issue and prevent similar vulnerabilities in other applications, developers must ensure that all authorization guards involving asynchronous operations are properly awaited before proceeding with sensitive actions. In JavaScript environments using Promises or async/await syntax, it is imperative to use the await keyword when calling functions like canExport to guarantee that the boolean result reflects the actual outcome of the permission check rather than a truthy Promise object. Upgrading Wekan to version 9.74 or later resolves this defect by correcting the asynchronous handling logic in models/exportExcel.js and models/server/ExporterExcel.js, thereby restoring proper access control enforcement for board exports.