Authorization Flaw in Wekan Open Source Kanban by Wekan, Allowing Unauthorized Access
CVE-2026-68559

6.5MEDIUM

Key Information:

Vendor

Wekan

Status
Wekan
Vendor
CVE Published:
19 August 2026

What is CVE-2026-68559?

Wekan, an open-source kanban tool built on Meteor, contains an authorization flaw due to improper handling of asynchronous operations within its export functionality. Specifically, the /api/boards/:boardId/exportExcel route fails to properly wait for the authorization check before allowing access to sensitive board information. As a result, any authenticated user, even those without proper membership, can export private board details such as card titles, descriptions, lists, swimlanes, member data, and additional metadata. This flaw has been remedied in version 9.74.

Affected Version(s)

wekan >= 9.57, < 9.74

References

https://github.com/wekan/wekan/security/advisories/GHSA-m...
x_refsource_CONFIRM
https://github.com/wekan/wekan/commit/7bbd1a3fad5d868fd01...
x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.74
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.