PT-2026-7715 · Kanboard · Kanboard

Drkim-Dev · Publicado 2026-02-11 · Atualizado 2026-02-14 · CVE-2026-25924

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.50

Description Kanboard is project management software based on the Kanban methodology. A security control bypass allows an authenticated administrator to achieve Remote Code Execution (RCE). The application does not properly verify a security setting, allowing an attacker to force the server to download and install a malicious plugin, leading to arbitrary code execution. The vulnerable endpoint bypasses the PLUGIN INSTALLER configuration when set to false.

Recommendations Update to version 1.2.50 or later.

Exploit

Correção

RCE

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-25924

GHSA-GRCH-P7VF-VC4F

Produtos afetados

Kanboard

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25924.json · Exploit
• https://github.com/kanboard/kanboard/commit/b9ada89b1a64034612fc4262b88c42458c0d6ee4 · Correção
• https://github.com/kanboard/kanboard/security/advisories/GHSA-grch-p7vf-vc4f · Aviso do Fabricante
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25924 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2022683716414480716 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-25924 · Nota de Segurança
• https://twitter.com/CVEnew/status/2021689991798092195 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25924 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-25924 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-25924 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-25924 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25924 · Aviso do Fabricante