Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kanboard - CVE-2026-29056
Published: November 9, 2026
Vulnerability identifier: #VU162629
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-29056
CWE-ID: CWE-915
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an invited attacker to gain full administrative access to Kanboard during account registration.
The vulnerability exists due to mass assignment in the user invite registration endpoint, which accepts the submitted role field without restricting assignment of administrative privileges. An invited attacker can submit role=app-admin with a valid invitation token to create an administrator account instead of a standard user account.
Affected software
Kanboard
How to mitigate CVE-2026-29056
Install security update from vendor's website.
Kanboard - update to 1.2.51