CVE-2026-25530

Katalog CVE

CVSS 4.3 · Medium EPSS 0,40%

Kerentanan Authorization Bypass Through User-Controlled Key pada kanboard. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.

Rincian

Terbit di NVD

10 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kanboard/kanboard/security/advisories/GHSA-6rxw-vvvj-r93q exploit · mitigasi · advisory vendor
• https://github.com/kanboard/kanboard/commit/c3d8d20e05322b09e036fed7afb57194d624a414 patch
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50 product · release notes