Wekan CVE-2026-68901

The four export API endpoints must be network-reachable: /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel. The attacker must supply any value in the authToken query parameter that does not correspond to an active user session - an entirely fabricated or random token string qualifies. No valid board ID is required to trigger the crash because the user lookup fails before board authorization is evaluated. What limits exploitation: (1) the target board ID must be guessable or leaked (though any board ID suffices since the crash precedes authorization checks), and (2) the export endpoints must not be blocked by a reverse proxy or WAF. The CVSS PR:L rating suggests the vendor considers some minimal access required, but the crash mechanism described operates on an invalid - not merely low-privilege - token, indicating no valid prior authentication is needed to reach the vulnerable code path.

The NVD-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a Medium-severity, network-exploitable DoS with no confidentiality or integrity impact. The availability impact is rated High because a single request crashes the entire server process, not just the requesting session. The PR:L designation warrants scrutiny: the crash is triggered by an invalid token - a value that matches no valid session - meaning an attacker needs no prior valid credentials, only network reach to the export endpoints. This suggests the true exploitation barrier may be closer to PR:N than PR:L. No EPSS score was provided in the input data. No KEV listing and no public exploit code exist at time of analysis; exploitation probability is inferred as moderate given the attack path is fully described in the public security advisory and the fix commit includes a detailed explanation of the crash mechanism. The attack is automatable (AC:L, no UI required) and a single request suffices, making this a realistic operational risk for any internet-exposed Wekan deployment. Teams should treat upgrade to v10.38 as routine but timely maintenance, not an emergency.

An attacker with network access to an exposed Wekan instance sends a single GET request such as GET /api/boards/<any-boardId>/export?authToken=AAAA to the server. ReactiveCache.getUser('AAAA') returns undefined because no session matches that token; the handler then executes undefined._id.toString(), producing a TypeError. Meteor's async runtime treats this as an unhandled rejection and terminates the Node.js process, taking all active Wekan sessions offline until an administrator restarts the service. Repeated requests prevent recovery, sustaining a denial-of-service condition indefinitely.