CVE-2026-68901: WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service
Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlled authToken query parameter and immediately called user.id.toString() without checking whether ReactiveCache.getUser() returned undefined. A request for a private board with an unknown token therefore threw a TypeError from an asynchronous route, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard after every export token lookup and wraps export handlers with safeRoute() so unexpected exceptions become controlled responses. This issue is fixed in version 10.38.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wekanto a version that resolves this vulnerability.Fixed in 10.38
Event History
Frequently Asked Questions
Which deployments are exposed?
Wekan versions prior to 10.38 are affected when the vulnerable board export endpoints are reachable. The issue is triggered when requesting a private board export with an unknown authToken query parameter.
What does an attacker need to exploit this issue?
An attacker needs network access to the affected REST endpoints and a private board ID. No valid authentication token or user interaction is required; supplying an unknown authToken causes the vulnerable user lookup to dereference an undefined value.
What is the impact of a successful request?
The request can raise an unhandled asynchronous exception that terminates the Wekan process, denying service to all users. The supplied information identifies no confidentiality or integrity impact.
What should teams do if they cannot patch immediately?
Restrict network access to the affected export REST endpoints, particularly for private boards, until Wekan can be upgraded. Version 10.38 adds invalid-token checks and converts unexpected export-handler exceptions into controlled responses.