Executive brief
Kanboard is an open-source project management software. A security flaw allows any logged-in user to prematurely end the "Remember Me" login sessions of other users, including administrators. While this does not allow an attacker to steal data or take over accounts, it can be used to disrupt operations by repeatedly forcing all users to log back into the system.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `UserViewController::removeSession` method. The application fails to verify that the `id` parameter (representing a session row in the database) belongs to the currently authenticated user before passing it to `RememberMeSessionModel::remove`. Because session IDs are sequential auto-incrementing integers, an authenticated attacker can enumerate these IDs to mass-invalidate persistent login sessions across the entire instance. This results in a session-based denial of service, forcing re-authentication for all affected users. The issue is fixed in commit 928c68a by constraining the database removal query with the authenticated user's ID.
Affected products
- Kanboard Kanboard through 1.2.52
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub
- 2026-06-05: patched: Fix merged into main branch via commit 928c68a
- 2026-06-25: advisory: CVE published and NVD entry created