CVE-2026-24885: Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the…

PriorityP340high8CVSS 3.1

AVNACLPRLUIRSUCHIHAH

EPSS

0.18%

7.9th percentile

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although the request body is JSON, the server accepts text/plain, allowing an attacker to craft a malicious form using the text/plain attribute. Which allows unauthorized modification of project user roles if an authenticated admin visits a malicious site This vulnerability is fixed in 1.2.50.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	kanboard	< kanboard 1.2.50+ds-1 (forky)	kanboard 1.2.50+ds-1 (forky)
kanboard	kanboard	< 1.2.50	1.2.50
kanboard	kanboard	>= 0 < 1.2.50+ds-1	1.2.50+ds-1

CVSS provenance

nvdv3.18.0HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

osv8.0HIGH

vendor_debian5.7MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.