PT-2026-26024 · Kanboard · Kanboard

Cydave · Publicado 2026-03-18 · Atualizado 2026-03-19 · CVE-2026-33058

Positive Technologies (AI Summary)

CVSS v4.0

8.4

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.51

Description Kanboard is project management software focused on the Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection issue. Attackers with permission to add users to a project can exploit this to dump the entire Kanboard database. The vulnerability allows for SQL injection through the addition of users to a project. The add users functionality is the point of exploitation. Version 1.2.51 resolves this issue.

Recommendations Versions prior to 1.2.51 should be updated to version 1.2.51 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-33058

GHSA-F62R-M4MR-2XHH

Produtos afetados

Kanboard

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33058.json · Exploit
• https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhh · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-33058 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034268157842530767 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33058 · Nota de Segurança
• https://twitter.com/_r_netsec/status/2034562543293956197 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33058 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034136420772724941 · Publicação no Twitter
• https://twitter.com/secharvesterx/status/2034601003727655363 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33058 · Aviso do Fabricante
• https://twitter.com/CVEarity/status/2034163118755221991 · Publicação no Twitter