CVE-2026-68559: Wekan Auth Bypass Vulnerability

CVE-2026-68559 Overview

CVE-2026-68559 is a broken access control vulnerability in Wekan, an open source kanban board built with Meteor. The flaw affects the /api/boards/:boardId/exportExcel route in versions 9.57 through 9.73. The route calls the asynchronous exporterExcel.canExport(user) authorization guard without awaiting its result. The returned Promise evaluates as truthy, so the export executes even when board.isVisibleBy(user) would deny access. Any authenticated non-member can download private board data. The issue is fixed in version 9.74 and is tracked under [CWE-639].

Critical Impact
Authenticated users can exfiltrate private Wekan board contents, including card titles, descriptions, lists, swimlanes, members, and metadata, bypassing board membership checks.

Affected Products

Wekan versions 9.57 through 9.73
Wekan Excel export API endpoint /api/boards/:boardId/exportExcel
Deployments running the ExporterExcel module in models/server/ExporterExcel.js

Discovery Timeline

2026-08-19 - CVE-2026-68559 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-68559

Vulnerability Analysis

The vulnerability resides in the Excel export route defined in models/exportExcel.js. The handler instantiates ExporterExcel and gates the export behind exporterExcel.canExport(user). Because canExport returns a Promise and the call site does not await it, JavaScript evaluates the Promise object itself as truthy. The subsequent exporterExcel.build(res) call proceeds regardless of the underlying board.isVisibleBy(user) decision. Attackers who hold a valid Wekan session can request any known boardId and receive an Excel workbook containing every card title, description, list, swimlane, member reference, and board metadata field, even for boards they were never invited to.

Root Cause

The root cause is a missing await on an asynchronous authorization check. The guard function was refactored to return a Promise, but the caller retained the synchronous invocation pattern. This turns the access control check into a no-op because Promise objects are always truthy in a boolean context. The pattern is a common instance of [CWE-639] Authorization Bypass Through User-Controlled Key, combined with an async/await handling defect.

Attack Vector

Exploitation requires a low-privilege authenticated account on the target Wekan instance and knowledge or enumeration of a target boardId. The attacker sends an HTTP request to /api/boards/:boardId/exportExcel with a valid session token. The server returns the Excel export of the requested board even when the requester is not a member.

javascript

// Patch diff from models/exportExcel.js - Fix ExcelBleed
    }

    const exporterExcel = new ExporterExcel(boardId, userLanguage);
-    if (exporterExcel.canExport(user) || impersonateDone) {
+    if ((await exporterExcel.canExport(user)) || impersonateDone) {
      if (impersonateDone) {
        await ImpersonatedUsers.insertAsync({
          adminId: adminId,

Source: Wekan commit 7bbd1a3

Detection Methods for CVE-2026-68559

Indicators of Compromise

Unexpected HTTP GET requests to /api/boards/:boardId/exportExcel from users who are not listed as board members
Bulk enumeration of boardId values from a single authenticated session in access logs
Outbound Excel (.xlsx) responses from the Wekan API to accounts outside the target board's membership

Detection Strategies

Cross-reference Wekan application logs of Excel export calls against board membership records to identify unauthorized exports.
Alert on authenticated users issuing exportExcel requests at a rate significantly above baseline or across many distinct board IDs.
Review reverse proxy or WAF logs for repeated /api/boards/*/exportExcel calls returning HTTP 200 with binary payloads.

Monitoring Recommendations

Enable verbose access logging on the Wekan API tier and forward logs to a central SIEM for correlation.
Track the Wekan release version in asset inventories and flag any host still running versions 9.57 through 9.73.
Monitor Meteor server logs for authorization decisions emitted by ExporterExcel.canExport after applying the patch.

How to Mitigate CVE-2026-68559

Immediate Actions Required

Upgrade all Wekan deployments to version 9.74 or later, which awaits the canExport Promise before invoking build(res).
Audit access logs from the first deployment of any version between 9.57 and 9.73 to identify prior unauthorized exports.
Rotate or review sensitivity of data stored on Wekan boards that may have been exposed to non-member accounts.

Patch Information

The fix is delivered in Wekan version 9.74. The corrective change adds an await to the authorization guard call in models/exportExcel.js, ensuring canExport(user) resolves to a boolean before the export runs. Full details are available in the Wekan Security Advisory GHSA-mwq8-ccpm-r533 and the Wekan v9.74 release notes.

Workarounds

If patching is not immediately possible, disable the Excel export route at the reverse proxy or ingress by blocking /api/boards/*/exportExcel.
Restrict Wekan API access to trusted networks using network-level ACLs until version 9.74 can be deployed.
Reduce the account population able to authenticate to Wekan, limiting the exploitable user base.

bash

# Example NGINX block for the vulnerable route as a temporary mitigation
location ~ ^/api/boards/[^/]+/exportExcel$ {
    return 403;
}