CVE-2026-68901 in Wekan
Summary
by MITRE • 08/20/2026
Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlled authToken query parameter and immediately called user._id.toString() without checking whether ReactiveCache.getUser() returned undefined. A request for a private board with an unknown token therefore threw a TypeError from an asynchronous route, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard after every export token lookup and wraps export handlers with safeRoute() so unexpected exceptions become controlled responses. This issue is fixed in version 10.38.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in Wekan versions prior to 10.38 represents a critical server-side failure rooted in improper error handling within the application's export functionality. Wekan, an open-source kanban board tool built on the Meteor framework, exposes several endpoints for exporting data, specifically /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel. These handlers are designed to process export requests based on authentication tokens provided by the user. However, a fundamental flaw exists in how these endpoints validate the authenticity of incoming requests before proceeding with data processing logic.
The core technical defect lies in the asynchronous route handling mechanism within models/export.js and models/exportExcel.js. When an export request is received, the system attempts to look up the associated user by querying ReactiveCache.getUser() using a token provided via the authToken query parameter. In scenarios where this lookup fails because the token does not correspond to any valid user or belongs to a private board with unauthorized access, the function returns undefined. The code subsequently invokes user._id.toString() on this undefined value without performing an existence check. This operation triggers a TypeError exception within an asynchronous context.
In JavaScript environments such as Meteor, unhandled promise rejections in asynchronous functions can lead to severe stability issues if not properly caught and managed. In the affected versions of Wekan, these TypeErrors were not intercepted by any error handling middleware or try-catch blocks specific to the export routes. Consequently, the exception propagated up the call stack without a corresponding response being sent back to the client. This results in an unhandled rejection that causes the Node.js process hosting the Wekan application to crash abruptly.
The operational impact of this vulnerability is significant as it constitutes a Denial of Service condition. An attacker does not require valid credentials or knowledge of specific board structures to exploit this flaw. By sending a crafted HTTP request with a malformed or non-existent authentication token to any of the vulnerable export endpoints, an external actor can trigger the TypeError and force the application process to terminate. Since Wekan typically runs as a single long-lived Node.js process, its termination results in immediate service unavailability for all connected users until the server is manually restarted by an administrator. This allows for persistent disruption of collaborative workflows without needing elevated privileges or complex exploitation techniques.
From a classification perspective, this vulnerability aligns with CWE-754: Improper Check for Unusual or Exceptional Conditions, as the application fails to validate input and handle error states appropriately before dereferencing object properties. It also relates to CWE-252: Unchecked Return Value, where the return value of a critical function call is not verified against failure conditions. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates Availability Impact through resource exhaustion or service disruption techniques, specifically leveraging software faults rather than traditional exploitation vectors like buffer overflows or injection attacks.
The resolution implemented in Wekan version 10.38 addresses these issues by introducing robust defensive programming practices into the export handlers. The fix includes adding a forty-one unauthorized guard immediately after every token lookup to ensure that requests lacking valid authentication are rejected with an appropriate HTTP status code before any further processing occurs. Additionally, the export handlers were wrapped in safeRoute() functions provided by the Meteor framework or custom middleware designed to catch asynchronous exceptions and convert them into controlled error responses rather than allowing unhandled rejections to crash the process. These changes ensure that invalid inputs result in standard error messages rather than system crashes, thereby restoring service stability and preventing denial of service attacks via this vector.
To mitigate similar risks in other applications or during the transition period for Wekan users, it is essential to enforce strict input validation on all authentication parameters before they are used to query user databases. Developers should always verify that database lookups return valid objects before accessing their properties. Furthermore, implementing global error handlers for asynchronous routes can prevent unhandled rejections from terminating application processes. For organizations running older versions of Wekan, immediate upgrading to version 10.38 or later is the primary remediation step. Until then, deploying a reverse proxy in front of the service that drops requests with malformed authentication headers may provide partial protection against automated exploitation attempts targeting these specific endpoints.