CVE-2026-68901

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 10.38

Description An issue exists where the handlers for the endpoints '/api/boards/:boardId/export', '/api/boards/:boardId/attachments/:attachmentId/export', '/api/boards/:boardId/export/csv', and '/api/boards/:boardId/exportExcel' in models/export.js and models/exportExcel.js fail to verify if ReactiveCache.getUser() returns undefined when processing the authToken query parameter. A request for a private board using an unknown token triggers a TypeError within an asynchronous route, leading to an unhandled rejection that can terminate the process and cause a denial of service for all users.

Recommendations Update to version 10.38.