Description

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T20:17:21.080Z",
  "pubdate": "2026-08-19T20:17:21.080Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Wekan open-source kanban application built with Meteor, specifically affecting versions 9.57 through 9.74.\nThe flaw resides in the /api/boards/:boardId/exportExcel route located within models/exportExcel.js.\nThe vulnerability allows any authenticated non-member user to bypass access controls and successfully download sensitive private board data, including card titles, descriptions, lists, swimlanes, members, and metadata.\nThe root cause stems from an unawaited asynchronous authorization guard, which incorrectly evaluates Promise objects as truthy regardless of the underlying access denial logic.\nThe risk implication is unauthorized data exposure of confidential project management boards to any authenticated user within the system.\nExploitation requires network access to the Wekan instance and a valid low-privileged authenticated user session, but does not require membership to the targeted private boards.",
  "technicalDetails": "The vulnerability affects Wekan versions 9.57 to 9.74 and originates in the file models/exportExcel.js at the specific API route /api/boards/:boardId/exportExcel.\nThe vulnerable component invokes the asynchronous authorization guard exporterExcel.canExport(user) defined in models/server/ExporterExcel.js.\nThe software flaw is characterized by failing to use the await keyword when calling this asynchronous function.\nBecause the function is asynchronous, calling it without awaiting returns a Promise object instead of resolving the Boolean result of the internal board.isVisibleBy(user) permission check.\nIn JavaScript, a Promise object evaluates to a truthy value regardless of whether the asynchronous resolution yields true or false.\nConsequently, the conditional check always passes, allowing the subsequent exporterExcel.build(res) method execution to proceed even when access should be explicitly denied by the authorization logic.\nThe attack flow proceeds as follows: First, an authenticated attacker with standard non-member privileges identifies or guesses a target private board ID. Second, the attacker issues an HTTP GET request to the vulnerable endpoint /api/boards/:boardId/exportExcel. Third, the server processes the request via the unawaited export route handler. Fourth, the authorization guard returns an unresolved Promise which evaluates as truthy. Fifth, the application bypasses the access check and initiates the Excel export generation. Sixth, the server returns the complete archive containing card titles, descriptions, lists, swimlanes, members, and metadata to the unauthorized user.\nThe exploitation prerequisites include network connectivity to the Wekan application server and standard authentication credentials, requiring no elevated administrative privileges or prior board membership."
}