CVE-2026-92802
published 2026-09-16CVE-2026-92802: kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking…
PriorityP425medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.37%
28.9th percentile
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kanbn | kan | <= 0.6.0 | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
kanbn kan up to 0.6.0 GitHub Project Import Endpoint improper authorization (EUVD-2026-81062)
vuldb·2026-09-17·CVSS 4.3
CVE-2026-92802 [MEDIUM] kanbn kan up to 0.6.0 GitHub Project Import Endpoint improper authorization (EUVD-2026-81062)
A vulnerability identified as problematic has been detected in kanbn kan up to 0.6.0. This affects an unknown part of the component GitHub Project Import Endpoint. This manipulation causes improper authorization.
This vulnerability is tracked as CVE-2026-92802. The attack is possible to be carried out remotely. No exploit exists.
GHSA
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission.
ghsa_unreviewed·2026-09-16
CVE-2026-92802 [MEDIUM] CWE-862 kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission.
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/kanbn/kanhttps://github.com/kanbn/kan/blob/f08920d/packages/api/src/routers/import.ts#L259https://github.com/kanbn/kan/blob/v0.6.0/packages/api/src/routers/import.ts#L622-L670https://github.com/kanbn/kan/issues/628https://www.vulncheck.com/advisories/kan-through-0.6.0-authorization-bypass-via-github-project-import
2026-09-16
Published