CVE-2026-21881

Critical

Published: 08/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Kanboard versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.

Risk Assessment

An attacker can gain administrator access, potentially leading to full system and data compromise.

Recommendation

Upgrade Kanboard to version 1.2.49 or later and configure trusted proxy to verify headers.

Original NVD description (English source)

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.