Kanboard vulnerabilities
28 CVEs and advisories name Kanboard as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-57862Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation
- CVE-2026-58660Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop
- CVE-2026-56774Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID
- CVE-2026-33058Kanboard has Authenticated SQL Injection in Project Permissions Handler
- CVE-2026-29056Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin
- CVE-2026-25531Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects
- CVE-2026-25924Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE
- CVE-2026-25530Kanboard is missing authorization check in getSwimlane API allows cross-project data access
- CVE-2026-24885Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment
- CVE-2026-21881Kanboard is Vulnerable to Reverse Proxy Authentication Bypass
- CVE-2026-21880Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure
- CVE-2026-21879Kanboard vulnerable to Open Redirect via protocol-relative URLs
- CVE-2025-55010Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events
- CVE-2025-55011Kanboard Path Traversal in File Write via Task File Upload Api
- CVE-2025-52576Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass
- CVE-2025-52560Kanboard Password Reset Poisoning via Host Header Injection
- CVE-2025-46825Kanboard has stored Cross-site Scripting vulnerability in project name
- CVE-2024-55603Insufficient session invalidation in Kanboard
- CVE-2024-54001Kanboard allows a persistent HTML injection site scripting in settings page date format
- CVE-2024-51747Arbitrary File Read and Delete in kanboard
- CVE-2024-51748Remote code execution through language setting in kanboard
- CVE-2024-36399Kanboard affected by Project Takeover via IDOR in ProjectPermissionController
- CVE-2023-36813Kanboard Authenticated SQL Injections vulnerability
- CVE-2023-33969Stored Cross site scripting in the Task External Link Functionality in Kanboard
- CVE-2023-33970Missing access control in internal task links feature in Kanboard
- CVE-2023-33968Missing Access Control allows User to move and duplicate tasks in Kanboard
- CVE-2023-33956Parameter based Indirect Object Referencing leading to private file exposure in Kanboard
- CVE-2023-32685Clipboard based cross-site scripting (blocked with default CSP) in Kanboard