PT-2026-26020 · Kanboard · Kanboard

Highfguillot · Publicado 2026-03-18 · Atualizado 2026-03-18 · CVE-2026-29056

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.51

Description Kanboard is project management software focused on the Kanban methodology. The user invite registration endpoint (UserInviteController::register()) accepts all POST parameters and passes them to UserModel::create() without filtering the role field. An attacker receiving an invite link can inject role=app-admin into the registration form to create an administrator account. The role parameter is vulnerable to injection.

Recommendations Versions prior to 1.2.51 should be updated to version 1.2.51 or later.

Exploit

Correção

LPE

Enumeração de Fraquezas

CWE-915

Identificadores relacionados

CVE-2026-29056

GHSA-2JVJ-Q44V-6P3X

Produtos afetados

Kanboard

Referências · 10

• 🔥 https://github.com/kanboard/kanboard/security/advisories/GHSA-2jvj-q44v-6p3x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29056.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-29056 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2034359361062285753 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-29056 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034136421653475489 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-29056 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034114573922431445 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-29056 · Nota de Segurança
• https://twitter.com/CVEarity/status/2034320407659172173 · Publicação no Twitter