CVE-2026-58660
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in Kanboard up to version 1.2.52 (fixed in commit 564cc30) allows an authenticated user who is a member of at least one project to move (hide/corrupt) tasks from any other project, including private ones they have no access to. The issue is in the save() method of BoardAjaxController, which does not verify that the supplied task_id actually belongs to the attacker-supplied project_id.
Risk Assessment
The organization is at risk of unauthorized task manipulation across the entire Kanboard instance, potentially leading to data loss, workflow disruption, and exposure of private project tasks.
Recommendation
Immediately update Kanboard to a version containing commit 564cc30 or later. If an update is not possible, restrict access to the drag-and-drop endpoint via firewall rules or disable the drag-and-drop feature.
Other vulnerabilities in Kanboard
See all- CVE-2017-12851High
An authenticated standard user could reset the password of the admin by altering form data. Affects kanboard before 1.0.46.
- CVE-2017-12850High
An authenticated standard user could reset the password of other users (including the admin) by altering form data. Affects kanboard before 1.0.46.
- CVE-2026-21881Critical
Kanboard versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.
- CVE-2026-57862High
An SSRF vulnerability in Kanboard 1.2.52 and prior allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs, enabling access to internal network resources such as cloud instance metadata services or localhost services.
- CVE-2026-56774Medium
A vulnerability in Kanboard up to version 1.2.52 (fixed in commit 928c68a) allows authenticated users to delete other users' Remember Me sessions. The UserViewController::removeSession function fails to validate the session ID parameter before passing it to RememberMeSessionModel::remove.
- CVE-2023-36813High
Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31 authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality.
- CVE-2023-33970Medium
In Kanboard, project management software, a vulnerability related to missing access control was identified. A user with the lowest privileges can access the titles of all tasks and projects, even if they are not invited or the project is personal.
- CVE-2023-33969Medium
Kanboard is project management software that allows for an XSS attack by storing malicious JavaScript code in tasks. Users viewing such a task will be exposed to the XSS attack.
- CVE-2023-33968Medium
Kanboard, an open source project management software, has a missing access control vulnerability in versions prior to 1.2.30. This allows low-privileged users to create or transfer tasks to any project, even if they have not been invited or the project is personal.
- CVE-2023-33956Medium
Kanboard, a project management software, has an Insecure Direct Object Reference (IDOR) vulnerability in versions prior to 1.2.30. This allows any user to read files uploaded by other users, regardless of their privileges.
Original NVD description (English source)
Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.