CVE-2026-68559

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68559
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68559.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68559
Aliases
  • GHSA-mwq8-ccpm-r533
Published
2026-08-19T19:20:32Z
Modified
2026-09-11T03:31:02Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
Details

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68559.json"
}
References

Affected packages

Git / github.com/wekan/wekan

Affected ranges

Type
GIT
Repo
https://github.com/wekan/wekan
Events
Introduced
a35e5dc12ce38325eafb75a95db20af2df5bb4fe
Fixed
7bbd1a3fad5d868fd01d79b5908913e215698e8e
Fixed
ca9bcfa4eeaf6293737f038381f4a3e91569f851
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "9.57"
        },
        {
            "fixed": "9.74"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v9.*
v9.57
v9.59
v9.60
v9.61
v9.62
v9.63
v9.64
v9.65
v9.67
v9.68
v9.69
v9.70
v9.71
v9.72
v9.73

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68559.json"