CyberRota Analysis
AI-GeneratedThe vulnerability affects Wekan versions 9.57 to 9.74, allowing authenticated non-members to access and download private board information, including card titles and member details, due to improper handling of the authorization check in the export functionality. This could lead to unauthorized exposure of sensitive project data. Organizations using affected versions should prioritize patching to version 9.74 to mitigate the risk of data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExport(user) authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always truthy, so exporterExcel.build(res) ran even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board card titles, descriptions, lists, swimlanes, members, and metadata. This issue is fixed in version 9.74.