CVE-2026-58660Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop
Updated under an hour ago ()
Does this affect you?
It affects kanboard. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weakness (CWE)
- CWE-639
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
kanboard kanboard kanboard:kanboard (from the name) | before 1.2.52; 564cc30e1e360959572e01e158734d9475c05903 not affected | CNA record |
References
- https://github.com/kanboard/kanboard/issues/5852technical-description, exploit
- https://github.com/kanboard/kanboard/pull/5853issue-tracking
- https://github.com/kanboard/kanboard/commit/564cc30e1e360959572e01e158734d9475c05903patch
- https://www.vulncheck.com/advisories/kanboard-boardajaxcontroller-missing-ownership-check-via-drag-and-dropthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.