CVE-2026-68901: Wekan Kanban DoS Vulnerability

CVE-2026-68901 Overview

CVE-2026-68901 is a denial of service vulnerability in Wekan, an open source kanban board built with Meteor. The flaw affects export API handlers in models/export.js and models/exportExcel.js prior to version 10.38. These handlers resolved a user from the attacker-controlled authToken query parameter and immediately called user._id.toString() without verifying that ReactiveCache.getUser() returned a defined value. An authenticated request for a private board using an unknown token triggers a TypeError from an asynchronous route. The resulting unhandled promise rejection can terminate the Wekan process and deny service to all users.

Critical Impact
A low-privileged authenticated attacker can crash the Wekan server remotely by issuing a single export request containing an invalid authToken, denying service to all users of the instance.

Affected Products

Wekan versions prior to 10.38
Wekan export API routes served by models/export.js
Wekan Excel export routes served by models/exportExcel.js

Discovery Timeline

2026-08-19 - CVE-2026-68901 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-68901

Vulnerability Analysis

The vulnerability resides in four export handlers: /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel. Each handler calls ReactiveCache.getUser() using the value of the authToken query parameter. The code then dereferences user._id.toString() without a null check. When the token does not correspond to any user, ReactiveCache.getUser() returns undefined, and the property access throws a TypeError.

Because the export routes are asynchronous, the thrown exception surfaces as an unhandled promise rejection. Node.js treats unhandled rejections as fatal in modern runtime configurations, terminating the Wekan process. All connected users lose access until the service restarts. This is a classic null pointer dereference pattern [CWE-476] adapted to a JavaScript execution context.

Root Cause

The root cause is missing input validation on the result of a lookup. The code assumed ReactiveCache.getUser(authToken) always returned a user object. No guard existed to reject requests where the token was unknown, expired, or malformed. Combined with an async route lacking centralized error handling, any exception propagated up as an unhandled rejection instead of a controlled HTTP response.

Attack Vector

An attacker with network access to a Wekan instance issues an HTTP GET request to any of the vulnerable export endpoints. The request includes an arbitrary invalid string in the authToken query parameter and any private board identifier. The handler attempts to resolve the token, receives undefined, and crashes the Node.js process. No valid credentials for the target board are required beyond the invalid token that fails resolution.

javascript

// Patch excerpt: models/exportExcel.js
// Adds safeRoute() wrapper so unexpected exceptions become controlled responses
runOnServer(function() {
  const { ExporterExcel } = require('./server/ExporterExcel');
  const { WebApp } = require('meteor/webapp');
+ const { safeRoute } = require('/server/apiMiddleware');
  const { Authentication } = require('/server/authentication');

  // todo XXX once we have a real API in place, move that route there

Source: GitHub Commit 40de1799

Detection Methods for CVE-2026-68901

Indicators of Compromise

Unexpected Wekan process terminations correlated with HTTP requests to /api/boards/*/export* endpoints.
HTTP access log entries containing the authToken query parameter with random or non-existent token values.
Repeated service restarts logged by the process supervisor (systemd, pm2, Docker restart policy) shortly after inbound export requests.

Detection Strategies

Monitor Node.js stderr for UnhandledPromiseRejection and TypeError: Cannot read properties of undefined (reading '_id') messages from Wekan.
Alert on request bursts targeting the four vulnerable export routes from a single source IP within a short window.
Correlate reverse proxy 5xx responses or connection resets with export API URIs to identify probing behavior.

Monitoring Recommendations

Ingest Wekan application and web server logs into a centralized logging platform and retain export API access records.
Track process uptime and crash counters for the Wekan service and alert when restart frequency exceeds a baseline.
Add synthetic health checks that fail if the Wekan API becomes unresponsive following suspicious export traffic.

How to Mitigate CVE-2026-68901

Immediate Actions Required

Upgrade Wekan to version 10.38 or later, which adds a 401 guard after every export token lookup and wraps handlers in safeRoute().
Restrict network access to the Wekan API using firewall rules or reverse proxy allowlists until the patch is applied.
Configure a process supervisor to automatically restart Wekan and reduce downtime if a crash occurs.

Patch Information

Wekan version 10.38 resolves CVE-2026-68901. The fix is tracked in commit 40de1799aed7c31494579659850578691171d895 and detailed in GitHub Security Advisory GHSA-3gcg-g6rf-w2rx. Release notes are available at GitHub Release v10.38. The patch adds a null check after ReactiveCache.getUser() that returns HTTP 401 for unknown tokens and introduces the safeRoute() middleware to convert unexpected exceptions into controlled HTTP responses.

Workarounds

Place Wekan behind a reverse proxy that rate-limits requests to /api/boards/*/export* endpoints and blocks anonymous traffic.
Require additional authentication (mTLS, VPN, or SSO gateway) in front of the Wekan API until version 10.38 is deployed.
Deploy Wekan under a supervisor such as systemd with Restart=always to shorten outage windows caused by process termination.

bash

# Upgrade Wekan to the patched release
docker pull wekanteam/wekan:v10.38
docker stop wekan && docker rm wekan
docker run -d --name wekan --restart=always \
  -p 8080:8080 \
  -e MONGO_URL=mongodb://mongo:27017/wekan \
  -e ROOT_URL=https://wekan.example.com \
  wekanteam/wekan:v10.38