CVE-2026-68901

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68901", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-31T21:04:04.039Z", "datePublished": "2026-08-19T19:27:58.094Z", "dateUpdated": "2026-08-19T19:40:09.254Z"}, "containers": {"cna": {"title": "WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service", "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "lang": "en", "description": "CWE-476: NULL Pointer Dereference", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/wekan/wekan/security/advisories/GHSA-3gcg-g6rf-w2rx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wekan/wekan/security/advisories/GHSA-3gcg-g6rf-w2rx"}, {"name": "https://github.com/wekan/wekan/commit/40de1799aed7c31494579659850578691171d895", "tags": ["x_refsource_MISC"], "url": "https://github.com/wekan/wekan/commit/40de1799aed7c31494579659850578691171d895"}, {"name": "https://github.com/wekan/wekan/releases/tag/v10.38", "tags": ["x_refsource_MISC"], "url": "https://github.com/wekan/wekan/releases/tag/v10.38"}], "affected": [{"vendor": "wekan", "product": "wekan", "versions": [{"version": "< 10.38", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T19:27:58.094Z"}, "descriptions": [{"lang": "en", "value": "Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlled authToken query parameter and immediately called user._id.toString() without checking whether ReactiveCache.getUser() returned undefined. A request for a private board with an unknown token therefore threw a TypeError from an asynchronous route, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard after every export token lookup and wraps export handlers with safeRoute() so unexpected exceptions become controlled responses. This issue is fixed in version 10.38."}], "source": {"advisory": "GHSA-3gcg-g6rf-w2rx", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/wekan/wekan/security/advisories/GHSA-3gcg-g6rf-w2rx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T19:39:34.384679Z", "id": "CVE-2026-68901", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T19:40:09.254Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68901", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T19:39:34.384679Z"}}}], "references": [{"url": "https://github.com/wekan/wekan/security/advisories/GHSA-3gcg-g6rf-w2rx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T19:39:52.739Z"}}], "cna": {"title": "WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service", "source": {"advisory": "GHSA-3gcg-g6rf-w2rx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "wekan", "product": "wekan", "versions": [{"status": "affected", "version": "< 10.38"}]}], "references": [{"url": "https://github.com/wekan/wekan/security/advisories/GHSA-3gcg-g6rf-w2rx", "name": "https://github.com/wekan/wekan/security/advisories/GHSA-3gcg-g6rf-w2rx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/wekan/wekan/commit/40de1799aed7c31494579659850578691171d895", "name": "https://github.com/wekan/wekan/commit/40de1799aed7c31494579659850578691171d895", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/wekan/wekan/releases/tag/v10.38", "name": "https://github.com/wekan/wekan/releases/tag/v10.38", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlled authToken query parameter and immediately called user._id.toString() without checking whether ReactiveCache.getUser() returned undefined. A request for a private board with an unknown token therefore threw a TypeError from an asynchronous route, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard after every export token lookup and wraps export handlers with safeRoute() so unexpected exceptions become controlled responses. This issue is fixed in version 10.38."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-19T19:27:58.094Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68901", "state": "PUBLISHED", "dateUpdated": "2026-08-19T19:40:09.254Z", "dateReserved": "2026-07-31T21:04:04.039Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-19T19:27:58.094Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wekan", "vendor": "wekan", "versions": [{"status": "affected", "version": "< 10.38"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel handlers in models/export.js and models/exportExcel.js looked up a user from the attacker-controlled authToken query parameter and immediately called user._id.toString() without checking whether ReactiveCache.getUser() returned undefined. A request for a private board with an unknown token therefore threw a TypeError from an asynchronous route, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard after every export token lookup and wraps export handlers with safeRoute() so unexpected exceptions become controlled responses. This issue is fixed in version 10.38."}, {"lang": "es", "value": "Wekan es un kanban de c\u00f3digo abierto construido con Meteor. Antes de la versi\u00f3n 10.38, los manejadores /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv y /api/boards/:boardId/exportExcel en models/export.js y models/exportExcel.js buscaban un usuario a partir del par\u00e1metro de consulta authToken controlado por el atacante e inmediatamente llamaban a user._id.toString() sin verificar si ReactiveCache.getUser() devolv\u00eda undefined. Una solicitud para un tablero privado con un token desconocido, por lo tanto, lanzaba un TypeError desde una ruta as\u00edncrona, produciendo un rechazo no manejado que pod\u00eda terminar el proceso de Wekan y denegar el servicio a todos los usuarios. La versi\u00f3n 10.38 a\u00f1ade una protecci\u00f3n 401 despu\u00e9s de cada b\u00fasqueda de token de exportaci\u00f3n y envuelve los manejadores de exportaci\u00f3n con safeRoute() para que las excepciones inesperadas se conviertan en respuestas controladas. Este problema est\u00e1 solucionado en la versi\u00f3n 10.38."}], "id": "CVE-2026-68901", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68901", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T19:39:34.384679Z", "version": "2.0.3"}}]}, "published": "2026-08-19T20:17:21.900", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/wekan/wekan/commit/40de1799aed7c31494579659850578691171d895"}, {"source": "security-advisories@github.com", "url": "https://github.com/wekan/wekan/releases/tag/v10.38"}, {"source": "security-advisories@github.com", "url": "https://github.com/wekan/wekan/security/advisories/GHSA-3gcg-g6rf-w2rx"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/wekan/wekan/security/advisories/GHSA-3gcg-g6rf-w2rx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,10.38)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wekan", "source": "cna", "vendor": "wekan"}, "product": "wekan", "vendor": "wekan"}], "created": "2026-08-19T22:45:06.522841+00:00", "updated": "2026-08-20T12:30:05.176796+00:00", "vendors": ["wekan", "wekan$PRODUCT$wekan"]}