PT-2026-7995 · Kanboard · Kanboard

S2Ongmo · Published 2026-01-01 · Updated 2026-02-13 · CVE-2026-25531

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.50

Description Kanboard is project management software based on the Kanban method. An issue exists in the TaskCreationController::duplicateProjects() endpoint where user permissions for target projects are not validated. This allows authenticated users to duplicate tasks into projects they should not have access to.

Recommendations Update to version 1.2.50 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-25531

GHSA-VRM3-3337-WHP9

Affected Products

Kanboard

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25531.json · Exploit
• https://github.com/kanboard/kanboard/security/advisories/GHSA-vrm3-3337-whp9 · Vendor Advisory
• https://github.com/kanboard/kanboard/commit/df7b7a21ee071f36466d8b38e40d0b0b8b8d394d · Patch
• https://ubuntu.com/security/CVE-2026-25531 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-25531 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25531 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25531 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25531 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25531 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25531 · Vendor Advisory
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50 · Note
• https://twitter.com/VulmonFeeds/status/2022340735794663907 · Twitter Post
• https://t.me/CVEtracker/44621 · Telegram Post
• https://twitter.com/CVEnew/status/2022337897190355279 · Twitter Post