CVE-2026-92802
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
Risk Assessment
Guests can create boards without proper permissions, potentially leading to unauthorized changes in the project and data integrity compromise.
Recommendation
Update kan to a version newer than 0.6.0 that includes the fix. Additionally, restrict access to the project import endpoint and monitor its usage.
Other vulnerabilities in kan
Original NVD description (English source)
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS