Wekan CVE-2026-68559

Exploitation requires a valid, authenticated Wekan session (any user account suffices - no elevated privileges or board membership needed). The attacker must know or enumerate at least one target board ID, which are UUIDs exposed through API responses for boards the attacker legitimately belongs to or potentially predictable. The affected route GET /api/boards/:boardId/exportExcel must be reachable from the attacker's network position. Exploitation is limited to Wekan versions 9.57-9.73 and does not affect the JSON export route (/api/boards/:boardId/export), which correctly awaited the same guard and returned HTTP 403 for non-members. No special configuration, non-default feature flag, or OS-level access is required beyond a valid session.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects real-world risk: network-accessible, trivially exploitable with no complexity, but requiring a valid Wekan session (PR:L). The confidentiality impact is high - full board contents including private data - while there is no integrity or availability impact. A read-only PoC was confirmed by the reporting researcher (sec-reex), so exploit construction is not a barrier. The vulnerability is not listed in CISA KEV, and EPSS data was not provided in the input. The risk profile is modest in absolute terms due to Wekan's limited deployment footprint, but for organizations relying on Wekan for sensitive project management, any authenticated internal user (or compromised account) can exfiltrate all private board data without detection beyond normal API logging. The recurring un-awaited async-auth pattern in this codebase (at least four prior instances) suggests the control gap may have been present across different attack surfaces for an extended period.

An attacker with any valid Wekan account - such as a contractor, a low-privilege employee, or an account compromised via credential stuffing - enumerates board IDs (which may be predictable UUIDs or discoverable via other API endpoints) and issues GET /api/boards/<boardId>/exportExcel requests for boards they are not a member of. Because the authorization guard is never evaluated, the server returns a full Excel export containing card titles, descriptions, assignees, swimlanes, and member lists for private boards. A read-only PoC confirming this behavior was provided by the reporter during responsible disclosure.