CVE-2026-58660 Details
Description
Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.
A vulnerability exists in Kanboard versions prior to 1.2.52 within the BoardAjaxController's save() method, which handles the kanban board's drag-and-drop functionality. The issue arises because the method validates the caller's role on the provided project_id but fails to ensure that the task_id being moved actually belongs to that project. Task IDs are sequential integers shared across the entire Kanboard instance, allowing any authenticated user who is a member of at least one project to enumerate and manipulate tasks from other projects, including private ones, where they have no membership or role. This exploitation can lead to tasks being corrupted or hidden from view.
Users can update to Kanboard version 1.2.52 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kanboard/kanboard/commit/564cc30e1e360959572e01e158734d9475c05903 | [email protected] | Source CodeVendor |
| https://github.com/kanboard/kanboard/issues/5852 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/kanboard/kanboard/pull/5853 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/kanboard-boardajaxcontroller-missing-ownership-check-via-drag-and-drop | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kanboard | < 1.2.52 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |