PT-2026-7318 · Kanboard · Kanboard

Sumeet-Darekar · Publicado 2026-01-01 · Atualizado 2026-02-10 · CVE-2026-24885

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.50

Description Kanboard is project management software. A Cross-Site Request Forgery (CSRF) issue exists in the ProjectPermissionController. The application does not strictly enforce the application/json Content-Type for the changeUserRole action, accepting text/plain instead. This allows an attacker to craft a malicious form and potentially modify project user roles if an authenticated administrator visits a malicious site. The vulnerable action is changeUserRole.

Recommendations Update to version 1.2.50 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-24885

GHSA-582J-H4W4-HWR5

Produtos afetados

Kanboard

Referências · 12

• 🔥 https://github.com/kanboard/kanboard/security/advisories/GHSA-582j-h4w4-hwr5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24885.json · Exploit
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50 · Nota
• https://github.com/kanboard/kanboard/commit/2c56d92783d4a3094812c2f7cba50f80a372f95e · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-24885 · Nota de Segurança
• https://twitter.com/CVEnew/status/2021279060123382186 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24885 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-24885 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-24885 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24885 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24885 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-24885 · Aviso do Fabricante