Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-68559 Wekan Private Board Data Exposure via Unawaited Export Route https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-68559
Post summary
The post announces CVE-2026-68559, describing it as a data exposure issue in Wekan caused by an unawaited export route, but provides no proof of exploitation, patch details, or False Positive claim.