Kanbn Kan vulnerabilities

CVE-2026-32255 [HIGH] CWE-918 CVE-2026-32255: Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatc Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can u

CVE-2026-110628 [HIGH] CWE-918 CVE-2026-110628: Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

CVE-2026-92802 [MEDIUM] CWE-862 CVE-2026-92802: kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.