SB2026110953 - Multiple vulnerabilities in Kanboard

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: CVE-2026-29056)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an invited attacker to gain full administrative access to Kanboard during account registration.

The vulnerability exists due to mass assignment in the user invite registration endpoint, which accepts the submitted role field without restricting assignment of administrative privileges. An invited attacker can submit role=app-admin with a valid invitation token to create an administrator account instead of a standard user account.

2) SQL injection (CVE-ID: CVE-2026-33058)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated attacker with permission to add users to a project to extract the entire Kanboard database.

The vulnerability exists due to insufficient validation of the external_id_column POST parameter in the project permissions handler when used as an SQL column identifier. An authenticated attacker can submit a crafted parameter value to inject SQL and retrieve sensitive database contents, including administrator API keys.

Remediation

Install update from vendor's website.

References

• https://github.com/kanboard/kanboard/security/advisories/GHSA-2jvj-q44v-6p3x
• https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhh