CVE-2023-33956
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Kanboard, a project management software, has an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.2.30. This allows any user to read files uploaded by other users, regardless of their privileges.
Risk Assessment
This vulnerability can lead to unauthorized disclosure of sensitive information, privacy breaches, and intellectual property theft. It may also result in financial losses and damage to user trust.
Recommendation
It is recommended to upgrade to version 1.2.30 or later to mitigate this vulnerability. There are no known workarounds for this issue.
Other vulnerabilities in Kanboard
See all- CVE-2017-12851High
An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.
- CVE-2017-12850High
An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.
- CVE-2026-21881Critical
Kanboard versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.
- CVE-2026-57862High
An SSRF vulnerability in Kanboard 1.2.52 and prior allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs, enabling access to internal network resources such as cloud instance metadata services or localhost services.
- CVE-2026-58660High
A vulnerability in Kanboard up to version 1.2.52 (fixed in commit 564cc30) allows an authenticated user who is a member of at least one project to move (hide/corrupt) tasks from any other project, including private ones they have no access to. The issue is in the save() method of BoardAjaxController, which does not verify that the supplied task_id actually belongs to the attacker-supplied project_id.
- CVE-2026-56774Medium
A vulnerability in Kanboard up to version 1.2.52 (fixed in commit 928c68a) allows authenticated users to delete other users' Remember Me sessions. The UserViewController::removeSession function fails to validate the session ID parameter before passing it to RememberMeSessionModel::remove.
- CVE-2023-36813High
Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31 authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality.
- CVE-2023-33970Medium
In Kanboard, project management software, a vulnerability related to missing access control was identified. A user with the lowest privileges can access the titles of all tasks and projects, even if they are not invited or the project is personal.
- CVE-2023-33969Medium
Kanboard is project management software that allows for an XSS attack by storing malicious JavaScript code in tasks. Users viewing such a task will be exposed to the XSS attack.
- CVE-2023-33968Medium
Kanboard, an open source project management software, has a missing access control vulnerability in versions prior to 1.2.30. This allows low-privileged users to create or transfer tasks to any project, even if they have not been invited or the project is personal.
Original NVD description (English source)
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any other user, regardless of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is image uploaded under **/files** directory regard less of uploaded by any user. This vulnerability poses a significant impact and severity to the application's security. By manipulating the URL parameter, an attacker can access sensitive files that should only be available to authorized users. This includes confidential documents or any other type of file stored within the application. The ability to read these files can lead to various detrimental consequences, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure of trade secrets. Additionally, it could result in legal and regulatory implications, reputation damage, financial losses, and potential compromise of user trust. Users are advised to upgrade. There are no known workarounds for this vulnerability.