Denial of Service Vulnerability in Wekan Kanban Board Software

CVE-2026-68901

What is CVE-2026-68901?

Wekan, an open source kanban board application built on Meteor, exhibits a vulnerability that can lead to denial of service. In versions prior to 10.38, specific API endpoints fail to validate the authenticity of user tokens supplied in request parameters. This oversight allows an attacker to exploit the system by submitting requests without proper authentication, potentially resulting in an unhandled TypeError that can crash the Wekan server. To address this issue, version 10.38 introduces robust checks, including a 401 guard and the use of controlled responses in export handlers, enhancing the application's resilience against unauthorized access and service interruptions.

References