CVE-2026-68899 is a stored XSS in Wekan's card attachment handler, but the real story is how the vulnerability emerged from a structural design flaw that treated security validation as an optional feature with graceful degradation — when the actual effect was silent failure that removed all content validation entirely.
The core issue: Wekan's detectMimeFromFile() function returns undefined when the file binary is unavailable. That return value was treated as a signal to fall back to the untrusted fileObj.type field supplied by the client. This creates a defense-in-depth failure disguised as an availability feature — the system degrades for deployments that don't install the file binary, but does so by removing all MIME validation. The attack surface is gated by WITH_API=true, meaning this isn't a universal Wekan flaw; it manifests only in specific deployment configurations where the API is enabled and the binary is absent.
This produces a dangerous asymmetry: a sysadmin running a minimal container to reduce attack surface inadvertently opened the vulnerability, while one who left the file binary in their image because it "came with the base image" got security for free without knowing why. The most security-conscious deployments were safe; the leanest ones were exposed.
The patch in version 9.90 introduces looksLikeDangerousMarkup() as a byte-inspection fallback, which is the correct architectural approach — moving validation into the application layer rather than depending on an external binary. However, this introduces a new heuristic that must be maintained and understood by future maintainers. Heuristics fossilize just as quickly as binary dependencies: in three years, someone may refactor "looksLikeDangerousMarkup" as unnecessary and reintroduce the same vulnerability through a different mutation.
What to check: Verify your Wekan deployment's WITH_API setting and whether the file binary is present in your container or environment. If you're running with the API enabled but without the binary, you're currently in the vulnerable state — the patch addresses this, but understanding your topology is essential for risk assessment. Audit any other security-critical logic that depends on optional external tools; those dependencies should either be enforced (fail hard if missing) or replaced with in-application validation.