CVE-2026-68900
The post-revocation exfiltration window is the analytically dominant feature of CVE-2026-68900, not its CVSS score. In this Wekan vulnerability, an attacker who plants an entity-encoded script payload in a card title can export the board while still a member, receive the HTML file, and then — after legitimate removal from the board — trigger execution when opening that locally-stored file, harvesting data they never legitimately saw. Membership revocation alone is an insufficient remediation for any member who exported before being removed. The root cause is a sanitization inconsistency between rendering contexts. The live Wekan interface uses textContent for untrusted values, preserving entity encoding and keeping payloads inert. The HTML export path interpolates the same data into innerHTML, causing the browser to reparse and decode entities — turning <script> into <script>. The fix in version 10.23 aligns both paths by constructing DOM nodes and using textContent for untrusted values. For defenders, the priority questions are exposure scope and legacy artifacts. First, determine whether any boards were exported between versions 8.72 and 10.23, and whether any coincide with membership removals. The EPSS score of 0.00252 reflects low automated scanning, but the actual threat model is surgical — a departing contractor, a disgruntled member, or anyone with legitimate-but-revokable access who exports before leaving. These actors don't appear in EPSS telemetry because they operate with intelligence, not automation. Second, recognize that the fix in 10.23 hardens the generation path but doesn't invalidate already-exported HTML files sitting in downloads folders, email attachments, or cloud backups. Those artifacts were generated under a different trust contract and remain exploitable if re-opened. There is no built-in mechanism to identify which historical exports are still circulating. This pattern — entity-encoded payload inert in live context, detonated in export context — has appeared at least three times in the past decade across different vendors. The institutional memory problem is acute: each instance converges on the same fix (canonicalize data flow so untrusted values never reach innerHTML), yet the knowledge doesn't transfer between teams. Actionable steps: patch to 10.23 immediately; audit board exports during the vulnerable window if logs permit; treat any exports from that period as potential compromises with no reliable way to confirm otherwise; and treat exports as security boundaries rather than neutral copy operations in future risk assessments.
Reviewed through automated stages and approved by a human before publication.