CVE-2026-68559

Name of the Vulnerable Software and Affected Versions Wekan versions 9.57 through 9.73

Description The /api/boards/:boardId/exportExcel endpoint in models/exportExcel.js fails to properly await the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js. Because the returned Promise is always truthy, the exporterExcel.build(res) function executes regardless of whether board.isVisibleBy(user) denies access. This allows any authenticated user who is not a member of a board to download private board data, including card titles, descriptions, lists, swimlanes, members, and metadata.

Recommendations Update Wekan to version 9.74.