What’s Vulnerable › Vulnerabilities

CVE-2026-68559: Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-10-26
• Weakness: CWE-639

Description

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.

Affected products

• WeKan: from 9.57, < 9.74

References

• https://github.com/wekan/wekan/commit/7bbd1a3fad5d868fd01d79b5908913e215698e8e
• https://github.com/wekan/wekan/releases/tag/v9.74
• https://github.com/wekan/wekan/security/advisories/GHSA-mwq8-ccpm-r533
• https://github.com/wekan/wekan/security/advisories/GHSA-mwq8-ccpm-r533

Get alerted when CVE-2026-68559 or the next vulnerability affects your stack