# cve.now: Kanboard

The newest entries naming Kanboard as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-57862](https://cve.now/CVE-2026-57862.md): Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation (CVSS 8.4)
- [CVE-2026-58660](https://cve.now/CVE-2026-58660.md): Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop (CVSS 7.2)
- [CVE-2026-56774](https://cve.now/CVE-2026-56774.md): Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID (CVSS 5.3)
- [CVE-2026-33058](https://cve.now/CVE-2026-33058.md): Kanboard has Authenticated SQL Injection in Project Permissions Handler (CVSS 8.4)
- [CVE-2026-29056](https://cve.now/CVE-2026-29056.md): Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin (CVSS 7.0)
- [CVE-2026-25531](https://cve.now/CVE-2026-25531.md): Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects (CVSS 4.3)
- [CVE-2026-25924](https://cve.now/CVE-2026-25924.md): Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE (CVSS 8.5)
- [CVE-2026-25530](https://cve.now/CVE-2026-25530.md): Kanboard is missing authorization check in getSwimlane API allows cross-project data access (CVSS 4.3)
- [CVE-2026-24885](https://cve.now/CVE-2026-24885.md): Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment (CVSS 5.7)
- [CVE-2026-21881](https://cve.now/CVE-2026-21881.md): Kanboard is Vulnerable to Reverse Proxy Authentication Bypass (CVSS 9.1)
- [CVE-2026-21880](https://cve.now/CVE-2026-21880.md): Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure (CVSS 5.3)
- [CVE-2026-21879](https://cve.now/CVE-2026-21879.md): Kanboard vulnerable to Open Redirect via protocol-relative URLs (CVSS 4.7)
- [CVE-2025-55010](https://cve.now/CVE-2025-55010.md): Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events (CVSS 9.1)
- [CVE-2025-55011](https://cve.now/CVE-2025-55011.md): Kanboard Path Traversal in File Write via Task File Upload Api (CVSS 6.4)
- [CVE-2025-52576](https://cve.now/CVE-2025-52576.md): Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass (CVSS 5.3)
- [CVE-2025-52560](https://cve.now/CVE-2025-52560.md): Kanboard Password Reset Poisoning via Host Header Injection (CVSS 8.1)
- [CVE-2025-46825](https://cve.now/CVE-2025-46825.md): Kanboard has stored Cross-site Scripting vulnerability in project name (CVSS 1.3)
- [CVE-2024-55603](https://cve.now/CVE-2024-55603.md): Insufficient session invalidation in Kanboard (CVSS 6.5)
- [CVE-2024-54001](https://cve.now/CVE-2024-54001.md): Kanboard allows a persistent HTML injection site scripting in settings page date format (CVSS 5.5)
- [CVE-2024-51747](https://cve.now/CVE-2024-51747.md): Arbitrary File Read and Delete in kanboard (CVSS 9.1)
- [CVE-2024-51748](https://cve.now/CVE-2024-51748.md): Remote code execution through language setting in kanboard (CVSS 9.1)
- [CVE-2024-36399](https://cve.now/CVE-2024-36399.md): Kanboard affected by Project Takeover via IDOR in ProjectPermissionController (CVSS 8.2)
- [CVE-2023-36813](https://cve.now/CVE-2023-36813.md): Kanboard Authenticated SQL Injections vulnerability (CVSS 7.1)
- [CVE-2023-33969](https://cve.now/CVE-2023-33969.md): Stored Cross site scripting in the Task External Link Functionality in Kanboard (CVSS 6.4)
- [CVE-2023-33970](https://cve.now/CVE-2023-33970.md): Missing access control in internal task links feature in Kanboard (CVSS 5.4)
- [CVE-2023-33968](https://cve.now/CVE-2023-33968.md): Missing Access Control allows User to move and duplicate tasks in Kanboard (CVSS 5.4)
- [CVE-2023-33956](https://cve.now/CVE-2023-33956.md): Parameter based Indirect Object Referencing leading to private file exposure in Kanboard (CVSS 4.3)
- [CVE-2023-32685](https://cve.now/CVE-2023-32685.md): Clipboard based cross-site scripting (blocked with default CSP) in Kanboard (CVSS 4.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/kanboard
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.