PT-2026-60249 · Kanboard · Kanboard

George Chen · Publicado 2026-07-15 · Atualizado 2026-07-15 · CVE-2026-58660

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project id but never verifies that the supplied task id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-58660

Produtos afetados

Kanboard

Referências · 5

• 🔥 https://github.com/kanboard/kanboard/issues/5852 · Exploit
• https://github.com/kanboard/kanboard/commit/564cc30e1e360959572e01e158734d9475c05903 · Correção
• https://github.com/kanboard/kanboard/pull/5853 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-58660 · Nota de Segurança
• https://vulncheck.com/advisories/kanboard-boardajaxcontroller-missing-ownership-check-via-drag-and-drop · Nota