Kanboard
by Kanboard
Source repositories
CVEs (51)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-15204 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user. | ||
| CVE-2017-15203 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user. | ||
| CVE-2017-15202 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user. | ||
| CVE-2017-15201 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user. | ||
| CVE-2017-15200 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user. | ||
| CVE-2017-15199 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description. | ||
| CVE-2017-15198 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user. | ||
| CVE-2017-15197 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user. | ||
| CVE-2017-15196 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user. | ||
| CVE-2017-15195 | Med | 0.28 | 4.3 | 0.01 | Oct 11, 2017 | In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user. | ||
| CVE-2026-25531 | Med | 0.00 | 4.3 | 0.00 | Feb 13, 2026 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to… | ||
| CVE-2026-25924 | Hig | 0.00 | 8.4 | 0.00 | Feb 11, 2026 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin… | ||
| CVE-2026-25530 | Med | 0.00 | 4.3 | 0.00 | Feb 10, 2026 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50. | ||
| CVE-2026-24885 | Med | 0.00 | 5.7 | 0.00 | Feb 10, 2026 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json… | ||
| CVE-2026-21881 | Cri | 0.00 | 9.1 | 0.00 | Jan 8, 2026 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the… | ||
| CVE-2026-21880 | Med | 0.00 | 5.3 | 0.00 | Jan 8, 2026 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing… | ||
| CVE-2026-21879 | Med | 0.00 | 4.7 | 0.00 | Jan 8, 2026 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers… | ||
| CVE-2025-55011 | Med | 0.00 | 6.4 | 0.00 | Aug 12, 2025 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate whether the task_id parameter is a valid task id, nor does it check for path traversal. As a result, a malicious actor… | ||
| CVE-2025-55010 | Cri | 0.00 | 9.1 | 0.01 | Aug 12, 2025 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"]… | ||
| CVE-2025-52576 | Med | 0.00 | 5.3 | 0.00 | Jun 25, 2025 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker… |
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user.
- risk 0.28cvss 4.3epss 0.01
In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user.
- risk 0.00cvss 4.3epss 0.00
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to…
- risk 0.00cvss 8.4epss 0.00
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin…
- risk 0.00cvss 4.3epss 0.00
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.
- risk 0.00cvss 5.7epss 0.00
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json…
- risk 0.00cvss 9.1epss 0.00
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the…
- risk 0.00cvss 5.3epss 0.00
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing…
- risk 0.00cvss 4.7epss 0.00
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers…
- risk 0.00cvss 6.4epss 0.00
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate whether the task_id parameter is a valid task id, nor does it check for path traversal. As a result, a malicious actor…
- risk 0.00cvss 9.1epss 0.01
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"]…
- risk 0.00cvss 5.3epss 0.00
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker…
Page 2 of 3