{"apiVersion":"1.0","identifier":"CVE-2026-68901","description":"Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlled authToken query parameter and immediately called user._id.toString() without checking whether ReactiveCache.getUser() returned undefined. A request for a private board with an unknown token therefore threw a TypeError from an asynchronous route, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard after every export token lookup and wraps export handlers with safeRoute() so unexpected exceptions become controlled responses. This issue is fixed in version 10.38.","publishedAt":"2026-08-19T20:17:21","lastModifiedAt":"2026-08-19T20:17:21","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68901","cvssScore":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","epssProbability":0.00376,"riskScore":0.67,"affectedProduct":"Wekan","affectedVersions":"<10.38","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-68901","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-68901","en":"https://www.redsauce.net/en/cves/CVE-2026-68901","fr":"https://www.redsauce.net/fr/cves/CVE-2026-68901","pt":"https://www.redsauce.net/pt/cves/CVE-2026-68901","de":"https://www.redsauce.net/de/cves/CVE-2026-68901","sk":"https://www.redsauce.net/sk/cves/CVE-2026-68901","el":"https://www.redsauce.net/el/cves/CVE-2026-68901"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-68901"}}