Wekan’s export routes dereference a user object that may be null if an attacker supplies an invalid authToken in the query string. The resulting TypeError is not caught by the asynchronous handler, causing an unhandled rejection that can terminate the Wekan process. A crashed process denies service to all users, impacting availability. This flaw is a classic NULL pointer dereference (CWE-476).

The vulnerability exists in every Wekan installation running a version prior to 10.38. The affected modules are the export handlers located in models/export.js and models/exportExcel.js, which serve the /api/boards/:boardId/export, /api/boards/:boardId/attachments/:attachmentId/export, /api/boards/:boardId/export/csv, and /api/boards/:boardId/exportExcel endpoints. The fix is included in Wekan v10.38 and later.

The CVSS score is 6.5, indicating a moderate severity. EPSS is not available, so no current exploitation probability is reported, and the vulnerability is not catalogued in CISA’s KEV list. The likely attack vector is a remote attacker issuing crafted HTTP requests that include an unknown token; because the exploit does not require authentication, it can be carried out from the public network. The outcome is a process crash, leading to denial of service for all users. The lack of exploratory restriction makes the attack feasible for an adversary with network access to the Wekan API endpoints.