Description

Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlled authToken query parameter and immediately called user._id.toString() without checking whether ReactiveCache.getUser() returned undefined. A request for a private board with an unknown token therefore threw a TypeError from an asynchronous route, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard after every export token lookup and wraps export handlers with safeRoute() so unexpected exceptions become controlled responses. This issue is fixed in version 10.38.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T20:17:21.900Z",
  "pubdate": "2026-08-19T20:17:21.900Z",
  "executiveSummary": "Wekan prior to version 10.38 contains an unhandled exception vulnerability within its export functionality, leading to a denial of service (DoS) condition. The vulnerability arises from improper handling of authentication tokens passed via query parameters, resulting in a TypeError that crashes the underlying Node.js process.\nThe flaw affects Wekan installations running versions prior to 10.38, specifically impacting API export endpoints used for boards, attachments, CSV exports, and Excel exports. An unauthenticated attacker can exploit this vulnerability remotely by supplying an unknown or invalid authorization token to private board export routes.\nThe risk implication is severe for availability, as malicious or accidental requests using invalid tokens cause unhandled asynchronous rejections that terminate the entire Wekan application process, disrupting service for all legitimate users. Exploitation requires network access to the target Wekan instance and knowledge of a private board identifier, but does not require valid credentials or high privileges.",
  "technicalDetails": "The vulnerability resides in the export request handlers located within models/export.js and models/exportExcel.js, specifically affecting the following routes: /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel.\nThe root cause of the vulnerability is the lack of a null or undefined check following the retrieval of a user object via ReactiveCache.getUser() using an attacker-controlled authToken query parameter. When a request is made against a private board with an unknown or invalid token, ReactiveCache.getUser() returns undefined instead of a valid user document.\nSubsequently, the vulnerable code immediately invokes user._id.toString() without validating the existence of the user object. Because this operation attempts to access properties on an undefined reference, it triggers a synchronous TypeError within an asynchronous Express/Meteor route handler.\nThe attack flow proceeds as follows: First, an attacker identifies or targets a private board ID within the Wekan instance. Second, the attacker crafts an HTTP GET request to one of the vulnerable export endpoints, appending a crafted or invalid authToken query parameter. Third, the Wekan application attempts to resolve the user associated with the token, fails to find a matching user, and returns undefined. Fourth, the application attempts to execute .toString() on the undefined user object, generating an unhandled promise rejection.\nBecause the exception occurs in an asynchronous route without proper wrapping or try-catch blocks, the uncaught exception terminates the Node.js process running Wekan. This leads to an immediate denial of service, rendering the application unavailable to all concurrent users until the process is manually or automatically restarted by a process manager."
}