CVE-2026-25924

Katalog CVE

CVSS 8.4 · High EPSS 0,88%

Kerentanan Incorrect Authorization pada kanboard. Skor CVSS 3.1 8.4 (High) menurut NVD.

Deskripsi (NVD)

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the underlying backend endpoint fails to verify this security setting. An attacker can exploit this oversight to force the server to download and install a malicious plugin, leading to arbitrary code execution. This vulnerability is fixed in 1.2.50.

Rincian

Terbit di NVD

11 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 58,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kanboard/kanboard/security/advisories/GHSA-grch-p7vf-vc4f exploit · mitigasi · advisory vendor
• https://github.com/kanboard/kanboard/commit/b9ada89b1a64034612fc4262b88c42458c0d6ee4 patch
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50 product · release notes