WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service

Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)

Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID

Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)

Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens

Wekan has Cross-Board IDOR in Custom Fields Update Endpoints

WeKan < 8.19 Read-only Board Roles Can Update Cards

Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs

WeKan < 8.19 Cross-board Card Move Without Destination Authorization

Wekan: Checklist direct DDP updates can write checklist data into private boards

WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass

WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId

WeKan < 8.19 Attachments Publication Information Disclosure