PT-2026-26024 · Kanboard · Kanboard

Cydave · Published 2026-03-18 · Updated 2026-03-19 · CVE-2026-33058

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.51

Description Kanboard is project management software focused on the Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection issue. Attackers with permission to add users to a project can exploit this to dump the entire Kanboard database. The vulnerability allows for SQL injection through the addition of users to a project. The add users functionality is the point of exploitation. Version 1.2.51 resolves this issue.

Recommendations Versions prior to 1.2.51 should be updated to version 1.2.51 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33058

GHSA-F62R-M4MR-2XHH

Affected Products

Kanboard

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33058.json · Exploit
• https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhh · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33058 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33058 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33058 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2034268157842530767 · Twitter Post
• https://twitter.com/_r_netsec/status/2034562543293956197 · Twitter Post
• https://twitter.com/CVEnew/status/2034136420772724941 · Twitter Post
• https://twitter.com/secharvesterx/status/2034601003727655363 · Twitter Post
• https://twitter.com/CVEarity/status/2034163118755221991 · Twitter Post