CVE-2026-68901

CVE-2026-68901 is being classified as a 6.5 CVSS authorization bypass, and that rating is wrong. The vulnerability isn't a missing auth check — it's a process-level denial of service where a single malformed request can terminate Wekan for every user. The mechanism: user._id.toString() gets called on an undefined object when ReactiveCache.getUser() returns falsy for an attacker-supplied token. In a Meteor async route handler, that TypeError becomes an unhandled promise rejection. Node.js terminates the process. One unauthenticated request, infinite blast radius. The fix is instructive. They added a 401 guard — that addresses the auth surface. But they also wrapped handlers with safeRoute(), which catches exceptions at the boundary and returns controlled responses. That second change reveals what the real problem is: the framework defaults let unhandled rejections escape to process termination. ReactiveCache.getUser() returning undefined isn't a logic bug in isolation — it's the API design exposing that authentication state and reactive cache state are decoupled in ways the codebase wasn't built to navigate safely. The synchronous-seeming ReactiveCache API masks asynchronous failure modes, so the undefined case never surfaces during normal testing. The critical question: does this pattern exist elsewhere? ReactiveCache.getUser() is called across multiple routes. If the fix only addressed these four export endpoints, the same undefined-dereference assumption is now sediment in other parts of the codebase. Check every route that calls user._id or user.* immediately after a ReactiveCache lookup — if it assumes the user exists without a guard, it's the same vulnerability waiting to surface under different conditions. CVSS 6.5 doesn't model process termination from unhandled rejections because it's an architectural failure mode, not a resource exhaustion or logic bug. The EPSS of 0.00376 reflects that scanners don't see a typical injection signature — not that the risk is low. One request crashing the service for all users is a different threat class than the scoring suggests. Prioritize the safeRoute() audit across the codebase before waiting for the next crash report to reveal where the pattern survived the patch.

Reviewed through automated stages and approved by a human before publication.