CVE-2026-68559

The vulnerability in Wekan 9.57 through 9.73 is straightforward in execution but profound in implication. The export route handler calls `canExport(user)` — an async function — without `await`, so the authorization guard receives a Promise object instead of a boolean. Since all Promises are truthy in JavaScript, the conditional always evaluates true regardless of the user's actual permissions. Any authenticated user could export any board's data without membership. The fix in 9.74 adds the missing `await`, but that single line obscures a deeper architectural problem. Wekan's authorization layer appears to mix async guard functions with synchronous-looking conditionals throughout the codebase. This is the same semantic failure that has appeared in CVE after CVE across different languages and frameworks since at least 2014 — the pattern is recurrent precisely because it looks intentional to static analysis and passes tests that mock authorization as synchronous. Audit your Wekan deployment for other async authorization functions called without await. Check export routes, board operations, card actions, and any model with permission gates. More importantly, treat any async authorization function as a structural risk — the architectural choice to permit async guards creates a class of bypass that cannot be audited by reviewing code patterns alone. Demand explicit type enforcement or linting rules that flag unawaited async calls in conditionals, or refactor authorization to be synchronous where feasible. The one-line fix closes this instance; the architecture keeps the vulnerability class alive.

Reviewed through automated stages and approved by a human before publication.