# CVE-2026-56774: Kanboard IDOR in UserViewController session removal

Source: https://junglewise.ai/threats/cve-2026-56774-kanboard-idor-in-userviewcontroller-session-removal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-56774 · Severity: medium · CVSS 5.4 · Published 2026-06-25

Kanboard is an open-source project management software. A security flaw allows any logged-in user to prematurely end the "Remember Me" login sessions of other users, including administrators. While this does not allow an attacker to steal data or take over accounts, it can be used to disrupt operations by repeatedly forcing all users to log back into the system.

Technologies: [Kanboard](https://junglewise.ai/threats/technologies/kanboard). Vendors: [Kanboard](https://junglewise.ai/threats/vendors/kanboard).

## Quick answers

**Is CVE-2026-56774 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56774 being exploited in the wild.

**How severe is CVE-2026-56774?** Medium severity, with a CVSS score of 5.4, published 25 June 2026.

**Which products and versions are affected?** Kanboard through 1.2.52.

**Is there a fix for CVE-2026-56774?** A patch was published on 2026-06-05: Fix merged into main branch via commit 928c68a Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56774 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-56774?** Check whether you run Kanboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `UserViewController::removeSession` method. The application fails to verify that the `id` parameter (representing a session row in the database) belongs to the currently authenticated user before passing it to `RememberMeSessionModel::remove`. Because session IDs are sequential auto-incrementing integers, an authenticated attacker can enumerate these IDs to mass-invalidate persistent login sessions across the entire instance. This results in a session-based denial of service, forcing re-authentication for all affected users. The issue is fixed in commit 928c68a by constraining the database removal query with the authenticated user's ID.

## Affected products

- Kanboard Kanboard through 1.2.52

## Timeline

- 2026-06-04: disclosed: Issue reported on GitHub
- 2026-06-05: patched: Fix merged into main branch via commit 928c68a
- 2026-06-25: advisory: CVE published and NVD entry created

## References

- [https://github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1](https://github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1)
- [https://github.com/kanboard/kanboard/issues/5829](https://github.com/kanboard/kanboard/issues/5829)
- [https://github.com/kanboard/kanboard/pull/5831](https://github.com/kanboard/kanboard/pull/5831)
- [https://www.vulncheck.com/advisories/kanboard-cross-user-deletion-of-persistent-login-sessions-via-unvalidated-session-id](https://www.vulncheck.com/advisories/kanboard-cross-user-deletion-of-persistent-login-sessions-via-unvalidated-session-id)

## Related threats

- [Kanboard SSRF filter bypass via hexadecimal IP notation](https://junglewise.ai/threats/cve-2026-57862-kanboard-ssrf-filter-bypass-via-hexadecimal-ip-notation)
- [Kanboard authorization bypass in BoardAjaxController drag-and-drop](https://junglewise.ai/threats/cve-2026-58660-kanboard-authorization-bypass-in-boardajaxcontroller-drag-and)