CVE-2026-24885

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although the request body is JSON, the server accepts text/plain, allowing an attacker to craft a malicious form using the text/plain attribute. Which allows unauthorized modification of project user roles if an authenticated admin visits a malicious site This vulnerability is fixed in 1.2.50.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/kanboard/kanboard/commit/2c56d92783d4a3094812c2f7cba50f80a372f95e	Patch
https://github.com/kanboard/kanboard/releases/tag/v1.2.50	Product Release Notes
https://github.com/kanboard/kanboard/security/advisories/GHSA-582j-h4w4-hwr5	Exploit Vendor Advisory
https://github.com/kanboard/kanboard/security/advisories/GHSA-582j-h4w4-hwr5	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-10 17:16

Updated : 2026-02-13 20:19

NVD link : CVE-2026-24885

Mitre link : CVE-2026-24885

CVE.ORG link : CVE-2026-24885

JSON object : View

Products Affected

kanboard

kanboard

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-24885", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2026-02-10T17:16:20.940", "references": [{"url": "https://github.com/kanboard/kanboard/commit/2c56d92783d4a3094812c2f7cba50f80a372f95e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kanboard/kanboard/releases/tag/v1.2.50", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-582j-h4w4-hwr5", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-582j-h4w4-hwr5", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although the request body is JSON, the server accepts text/plain, allowing an attacker to craft a malicious form using the text/plain attribute. Which allows unauthorized modification of project user roles if an authenticated admin visits a malicious site This vulnerability is fixed in 1.2.50."}, {"lang": "es", "value": "Kanboard es un software de gesti\u00f3n de proyectos centrado en la metodolog\u00eda Kanban. Antes de la versi\u00f3n 1.2.50, existe una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en el ProjectPermissionController dentro de la aplicaci\u00f3n Kanboard. La aplicaci\u00f3n no logra aplicar estrictamente el Content-Type application/json para la acci\u00f3n changeUserRole. Aunque el cuerpo de la petici\u00f3n es JSON, el servidor acepta text/plain, permitiendo a un atacante crear un formulario malicioso usando el atributo text/plain. Lo que permite la modificaci\u00f3n no autorizada de los roles de usuario del proyecto si un administrador autenticado visita un sitio malicioso. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.2.50."}], "lastModified": "2026-02-13T20:19:00.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1B88FC0-3CFD-4A8C-A9E4-9AAF4F1D51EE", "versionEndExcluding": "1.2.50"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}