Executive brief
kan is an open-source project management tool (Trello alternative) that manages teams and their work through boards. A flaw in the GitHub project import feature allows users without board-creation permissions to bypass authorization checks and create boards, circumventing intended access controls. Attackers could exploit this to gain unauthorized workspace manipulation without proper permission levels.
Technical details
The vulnerability is an authorization bypass in the importProjects GraphQL mutation endpoint. The root cause is insufficient permission validation—the GitHub project import code path fails to enforce the "board:create" permission check that is properly enforced in direct board creation flows. An unauthenticated or guest user can call the importProjects mutation to create boards, while the same user would be blocked via normal creation APIs. The attack requires network access to the GraphQL endpoint but does not require prior authentication or special preconditions beyond guest access. A patch is expected to add proper permission checks to the import handler.
Affected products
- kanbn kan through 0.6.0
Timeline
- 2026-09-16: disclosed