Quick answers
- Is CVE-2026-58660 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-58660 being exploited in the wild.
- How severe is CVE-2026-58660?
- High severity, with a CVSS score of 8.1, published 15 July 2026.
- Which products and versions are affected?
- Kanboard <= 1.2.52.
- Is there a fix for CVE-2026-58660?
- A patch was published on 2026-07-14: Fix merged into main branch via commit 564cc30 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-58660 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-58660?
- Check whether you run Kanboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authorization bypass (CWE-639) exists in the BoardAjaxController::save() method of Kanboard through version 1.2.52. The application validates the user's permissions against a provided project_id but fails to verify that the task_id being modified actually belongs to that project. Because task IDs are sequential integers shared globally across the instance, an authenticated attacker with access to at least one project can manipulate tasks in any other project by supplying a valid project_id they control and a target task_id from another project. This allows for unauthorized modification and potential denial of service (hiding tasks) across project boundaries. The issue is fixed in commit 564cc30.
Affected products
- Kanboard Kanboard <= 1.2.52
Timeline
- 2026-07-14: patched: Fix merged into main branch via commit 564cc30
- 2026-07-15: disclosed: Vulnerability published to NVD and VulnCheck