{"id":"CVE-2026-68559","summary":"Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)","details":"Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.","aliases":["GHSA-mwq8-ccpm-r533"],"modified":"2026-09-11T03:31:02.904248666Z","published":"2026-08-19T19:20:32.150Z","database_specific":{"cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68559.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/wekan/wekan/releases/tag/v9.74"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68559.json"},{"type":"ADVISORY","url":"https://github.com/wekan/wekan/security/advisories/GHSA-mwq8-ccpm-r533"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68559"},{"type":"FIX","url":"https://github.com/wekan/wekan/commit/7bbd1a3fad5d868fd01d79b5908913e215698e8e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wekan/wekan","events":[{"introduced":"a35e5dc12ce38325eafb75a95db20af2df5bb4fe"},{"fixed":"7bbd1a3fad5d868fd01d79b5908913e215698e8e"},{"fixed":"ca9bcfa4eeaf6293737f038381f4a3e91569f851"}],"database_specific":{"extracted_events":[{"introduced":"9.57"},{"fixed":"9.74"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v9.73","v9.72","v9.71","v9.70","v9.69","v9.68","v9.67","v9.65","v9.64","v9.63","v9.62","v9.61","v9.60","v9.59","v9.57"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68559.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}