CVE-2026-68559: Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wekanto a version that resolves this vulnerability.Fixed in 9.74
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Wekan user who is not a member of a private board can exploit it. The attacker needs network access to the Wekan instance and the target board's board ID.
What information can be exposed?
An unauthorized Excel export can disclose private board card titles and descriptions, lists, swimlanes, members, and board metadata. The issue affects confidentiality; no integrity or availability impact is described.
Which deployments are affected?
Wekan versions from 9.57 until 9.74 are affected. The vulnerable endpoint is /api/boards/:boardId/exportExcel, and the access-control failure applies to private boards.
How can I determine whether unauthorized access may already have occurred?
Review available application, proxy, or web-server logs for requests to /api/boards/:boardId/exportExcel by authenticated users who were not members of the requested boards. The provided information does not identify a separate audit event or indicator for successful unauthorized exports.