PT-2026-7318 · Kanboard · Kanboard

Sumeet-Darekar · Published 2026-01-01 · Updated 2026-02-10 · CVE-2026-24885

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.50

Description Kanboard is project management software. A Cross-Site Request Forgery (CSRF) issue exists in the ProjectPermissionController. The application does not strictly enforce the application/json Content-Type for the changeUserRole action, accepting text/plain instead. This allows an attacker to craft a malicious form and potentially modify project user roles if an authenticated administrator visits a malicious site. The vulnerable action is changeUserRole.

Recommendations Update to version 1.2.50 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-24885

GHSA-582J-H4W4-HWR5

Affected Products

Kanboard

References · 12

• 🔥 https://github.com/kanboard/kanboard/security/advisories/GHSA-582j-h4w4-hwr5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24885.json · Exploit
• https://github.com/kanboard/kanboard/commit/2c56d92783d4a3094812c2f7cba50f80a372f95e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-24885 · Security Note
• https://osv.dev/vulnerability/CVE-2026-24885 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-24885 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-24885 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24885 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24885 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24885 · Vendor Advisory
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50 · Note
• https://twitter.com/CVEnew/status/2021279060123382186 · Twitter Post