Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE

Description

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the underlying backend endpoint fails to verify this security setting. An attacker can exploit this oversight to force the server to download and install a malicious plugin, leading to arbitrary code execution. This vulnerability is fixed in 1.2.50.

Scores

EPSS (exploitation in 30 days)

0.58% · top 52% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.5.

Weakness

• CWE-863: Incorrect Authorization (opens in a new tab)All about CWE-863 and its CVEs

Affected products

• kanboard · kanboard

  • affected < 1.2.50

References (3)

• https://github.com/kanboard/kanboard/security/advisories/GHSA-grch-p7vf-vc4f (opens in a new tab)x_refsource_CONFIRM
• https://github.com/kanboard/kanboard/commit/b9ada89b1a64034612fc4262b88c42458c0d6ee4 (opens in a new tab)x_refsource_MISC
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-25924](https://trackcve.app/badge/CVE-2026-25924.svg)](https://trackcve.app/cve/CVE-2026-25924)

Record last updated 12 Feb 2026, 21:18 UTC.