| CVE | Vulnerability name | Date | Responsible Security Disclosure by | Vulnerabilities |
|---|---|---|---|---|
|
CVE-2026-68901 GHSA-3gcg-g6rf-w2rx
|
CrashBleed |
2026-07-26 |
laijunyue and xet7
Coordinated disclosure via GitHub Security Advisory. |
|
| Where | Details |
|---|---|
| Affected code |
The board export REST endpoints: three handlers in models/export.js and one in
models/exportExcel.js.
|
| Root cause |
The export endpoints look a user up by the login token in ?authToken=. A token
that matches nothing makes that lookup answer undefined, and the next line
dereferenced it:
user._id.toString()
which throws a TypeError out of an async route handler with no
try/catch. That escapes as an unhandled promise rejection, which this app turns
into a full process crash — so one crafted GET against a private board id took the server
down for every user, not just for the request that made it.
It was an incomplete fix. models/exportPDF.js and
models/exportExcelCard.js already had the if (!user) guard; four
other handlers were missed, which is exactly the kind of gap that survives a review done
file by file.
|
| Fix |
Fixed on both levels, because either alone leaves the other half of the problem.
Every token lookup in the export models is now followed by that guard — 401 Invalid token and return — including the two handlers that did not crash, because they hand the user to canExport() instead of dereferencing it. A handler that
happens not to crash today is one edit away from crashing tomorrow.
And every export route body is wrapped in safeRoute()
(server/apiMiddleware.js), which awaits the handler, answers 500 once and logs
the request that failed. A throw from any other cause is now one broken request instead of
an outage.
tests/exportTokenGuard.test.cjs finds every token lookup in the export models
and requires a guard on each, rather than checking the four known places by hand — the bug
was a missed site, so the guard has to be about all sites rather than about these.
|
| Timeline | Details |
|---|---|
| 2026-07-26 | Report received from laijunyue via GitHub Security Advisory. |
| 2026-07-26 | Fixed at Wekan v10.38 2026-07-26. |