CVE-2026-21880

Katalog CVE

CVSS 5.3 · Medium EPSS 0,40%

Kerentanan Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') pada kanboard. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerate all LDAP users, discover sensitive user attributes, and perform targeted attacks against specific accounts. This issue is fixed in version 1.2.49.

Rincian

Terbit di NVD

8 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 31,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kanboard/kanboard/security/advisories/GHSA-v66r-m28r-wmq7 exploit · advisory vendor
• https://github.com/kanboard/kanboard/commit/dd374079f7c2d1dab74c1680960e684ff8668586 patch
• https://github.com/kanboard/kanboard/releases/tag/v1.2.49 release notes