kanboard vulnerabilities

CVEs per yearBy the year they were published

1. 20236
2. 20245
3. 20255
4. 202612

Newest CVEs

• CVE-2026-57862

  Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation

  Kanboard · Kanboard

  High8.4
• CVE-2026-58660

  Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop

  kanboard · kanboard

  High7.2
• CVE-2026-56774

  Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID

  kanboard · kanboard

  Medium5.3
• CVE-2026-33058

  Kanboard has Authenticated SQL Injection in Project Permissions Handler

  kanboard · kanboard

  High8.4
• CVE-2026-29056

  Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin

  kanboard · kanboard

  High7.0
• CVE-2026-25531

  Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects

  kanboard · kanboard

  Medium4.3
• CVE-2026-25924

  Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE

  kanboard · kanboard

  High8.5
• CVE-2026-25530

  Kanboard is missing authorization check in getSwimlane API allows cross-project data access

  kanboard · kanboard

  Medium4.3
• CVE-2026-24885

  Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment

  kanboard · kanboard

  Medium5.7
• CVE-2026-21881

  Kanboard is Vulnerable to Reverse Proxy Authentication Bypass

  kanboard · kanboard

  Critical9.1