PT-2026-7995 · Kanboard · Kanboard

S2Ongmo · Publicado 2026-01-01 · Atualizado 2026-02-13 · CVE-2026-25531

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.50

Description Kanboard is project management software based on the Kanban method. An issue exists in the TaskCreationController::duplicateProjects() endpoint where user permissions for target projects are not validated. This allows authenticated users to duplicate tasks into projects they should not have access to.

Recommendations Update to version 1.2.50 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-25531

GHSA-VRM3-3337-WHP9

Produtos afetados

Kanboard

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25531.json · Exploit
• https://github.com/kanboard/kanboard/security/advisories/GHSA-vrm3-3337-whp9 · Aviso do Fabricante
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50 · Nota
• https://github.com/kanboard/kanboard/commit/df7b7a21ee071f36466d8b38e40d0b0b8b8d394d · Correção
• https://twitter.com/VulmonFeeds/status/2022340735794663907 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-25531 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-25531 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-25531 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25531 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25531 · Aviso do Fabricante
• https://t.me/CVEtracker/44621 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-25531 · Nota de Segurança
• https://twitter.com/CVEnew/status/2022337897190355279 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-25531 · Aviso do Fabricante