CVE-2026-58660
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Kanboard before 1.2.53 (fixed in commit 564cc30) has a flaw in the BoardAjaxController save() method used by the kanban drag-and-drop endpoint. The caller's role is validated against the attacker-supplied project_id, but the supplied task_id is never verified to belong to that project, allowing any authenticated user who is a member of at least one project to move, corrupt, or hide tasks belonging to any other project, including private projects.
Risk Assessment
Any authenticated user who is a member of any project can modify or hide tasks in other projects, compromising confidentiality and integrity. This can lead to team sabotage and leakage of task information.
Recommendation
Update Kanboard to version 1.2.53 or later (commit 564cc30). Until patched, consider restricting user privileges and monitoring for unusual task changes.
Other vulnerabilities in Kanboard
See all- CVE-2017-12851High
An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.
- CVE-2017-12850High
An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.
- CVE-2026-21881Critical
Kanboard versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.
- CVE-2026-57862High
An SSRF vulnerability in Kanboard 1.2.52 and prior allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs, enabling access to internal network resources such as cloud instance metadata services or localhost services.
- CVE-2026-56774Medium
A vulnerability in Kanboard up to version 1.2.52 (fixed in commit 928c68a) allows authenticated users to delete other users' Remember Me sessions. The UserViewController::removeSession function fails to validate the session ID parameter before passing it to RememberMeSessionModel::remove.
- CVE-2023-36813High
Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31 authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality.
- CVE-2023-33970Medium
In Kanboard, project management software, a vulnerability related to missing access control was identified. A user with the lowest privileges can access the titles of all tasks and projects, even if they are not invited or the project is personal.
- CVE-2023-33969Medium
Kanboard is project management software that allows for an XSS attack by storing malicious JavaScript code in tasks. Users viewing such a task will be exposed to the XSS attack.
- CVE-2023-33968Medium
Kanboard, an open source project management software, has a missing access control vulnerability in versions prior to 1.2.30. This allows low-privileged users to create or transfer tasks to any project, even if they have not been invited or the project is personal.
- CVE-2023-33956Medium
Kanboard, a project management software, has an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.2.30. This allows any user to read files uploaded by other users, regardless of their privileges.
Original NVD description (English source)
Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS