CVE-2026-25530

Published: Feb 10, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.

Affected (1)

Products: Kanboard: Kanboard

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Kanboard Kanboard	Before 1.2.50

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (3)

https://github.com/kanboard/kanboard/commit/c3d8d20e05322b09e036fed7afb57194d624a414

Source: security-advisories@github.com

Patch

https://github.com/kanboard/kanboard/releases/tag/v1.2.50

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/kanboard/kanboard/security/advisories/GHSA-6rxw-vvvj-r93q

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

Timeline

No history available yet.