PT-2026-2116 · Kanboard · Kanboard

Huseynkhanli · Published 2026-01-08 · Updated 2026-01-20 · CVE-2026-21879

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kanboard versions 1.2.48 and below

Description Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are susceptible to an Open Redirect issue, allowing attackers to redirect authenticated users to malicious websites. Attackers can bypass the filter var($url, FILTER VALIDATE URL) validation check by crafting URLs such as //evil.com. This could be used to conduct phishing attacks, steal user credentials, or distribute malware.

Recommendations Update Kanboard to version 1.2.49 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-21879

GHSA-MHV9-7M9W-7HCQ

Affected Products

Kanboard

References · 12

• 🔥 https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21879.json · Exploit
• https://github.com/kanboard/kanboard/commit/93bcae03301a6d34185a8dba977417e6b3de519f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-21879 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-21879 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21879 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-21879 · Vendor Advisory
• https://github.com/kanboard/kanboard/releases/tag/v1.2.49 · Note
• https://t.me/CVEtracker/41669 · Telegram Post
• https://t.me/cveNotify/148035 · Telegram Post
• https://twitter.com/CVEnew/status/2009149979777224788 · Twitter Post
• https://t.me/cveNotify/149311 · Telegram Post