Executive brief
Kanboard, a popular open-source project management tool, contains a security flaw in its task management system. An authorized user of the system can move or hide tasks belonging to projects they are not members of, including private projects. This could lead to data corruption, loss of task visibility, and disruption of business operations across different teams or departments.
Technical details
An authorization bypass (CWE-639) exists in the BoardAjaxController::save() method of Kanboard through version 1.2.52. The application validates the user's permissions against a provided project_id but fails to verify that the task_id being modified actually belongs to that project. Because task IDs are sequential integers shared globally across the instance, an authenticated attacker with access to at least one project can manipulate tasks in any other project by supplying a valid project_id they control and a target task_id from another project. This allows for unauthorized modification and potential denial of service (hiding tasks) across project boundaries. The issue is fixed in commit 564cc30.
Affected products
- Kanboard Kanboard <= 1.2.52
Timeline
- 2026-07-14: patched: Fix merged into main branch via commit 564cc30
- 2026-07-15: disclosed: Vulnerability published to NVD and VulnCheck