https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33058.htmlhttps://patchthecve.com/cve/CVE-2026-33058.htmlWed, 17 Jun 2026 10:36:52 +0000MEDIUM 6.5: Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51 fixhttps://patchthecve.com/cve/CVE-2026-29056.htmlhttps://patchthecve.com/cve/CVE-2026-29056.htmlWed, 17 Jun 2026 10:29:31 +0000HIGH 8.8: Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field. An attacker who receihttps://patchthecve.com/cve/CVE-2026-25531.htmlhttps://patchthecve.com/cve/CVE-2026-25531.htmlWed, 17 Jun 2026 10:24:48 +0000MEDIUM 4.3: Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to duplicate tasks into projhttps://patchthecve.com/cve/CVE-2026-25924.htmlhttps://patchthecve.com/cve/CVE-2026-25924.htmlWed, 17 Jun 2026 10:25:26 +0000HIGH 8.4: Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface whhttps://patchthecve.com/cve/CVE-2026-25530.htmlhttps://patchthecve.com/cve/CVE-2026-25530.htmlWed, 17 Jun 2026 10:24:48 +0000MEDIUM 4.3: Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.https://patchthecve.com/cve/CVE-2026-24885.htmlhttps://patchthecve.com/cve/CVE-2026-24885.htmlWed, 17 Jun 2026 10:23:44 +0000MEDIUM 5.7: Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the chahttps://patchthecve.com/cve/CVE-2026-21881.htmlhttps://patchthecve.com/cve/CVE-2026-21881.htmlWed, 17 Jun 2026 10:19:04 +0000CRITICAL 9.1: Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a thttps://patchthecve.com/cve/CVE-2026-21880.htmlhttps://patchthecve.com/cve/CVE-2026-21880.htmlWed, 17 Jun 2026 10:19:04 +0000MEDIUM 5.3: Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerathttps://patchthecve.com/cve/CVE-2026-21879.htmlhttps://patchthecve.com/cve/CVE-2026-21879.htmlWed, 17 Jun 2026 10:19:04 +0000MEDIUM 4.7: Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filtehttps://patchthecve.com/cve/CVE-2025-55011.htmlhttps://patchthecve.com/cve/CVE-2025-55011.htmlWed, 17 Jun 2026 09:41:06 +0000MEDIUM 6.4: Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate whether the task_id parameter is a valid task id, nor does it check for path traversal. As a result, a malicious actor could write a file anhttps://patchthecve.com/cve/CVE-2025-55010.htmlhttps://patchthecve.com/cve/CVE-2025-55010.htmlWed, 17 Jun 2026 09:41:06 +0000CRITICAL 9.1: Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"] field in the projecthttps://patchthecve.com/cve/CVE-2025-52576.htmlhttps://patchthecve.com/cve/CVE-2025-52576.htmlWed, 17 Jun 2026 09:36:42 +0000MEDIUM 5.3: Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker can determine valid uhttps://patchthecve.com/cve/CVE-2025-52560.htmlhttps://patchthecve.com/cve/CVE-2025-52560.htmlWed, 17 Jun 2026 09:36:40 +0000HIGH 8.1: Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to https://patchthecve.com/cve/CVE-2025-46825.htmlhttps://patchthecve.com/cve/CVE-2025-46825.htmlWed, 17 Jun 2026 09:26:59 +0000MEDIUM 5.4: Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the `name` parameter of the `http://localhost/?controller=ProjectCreationController&action=create` form. This vulnerability allows https://patchthecve.com/cve/CVE-2024-55603.htmlhttps://patchthecve.com/cve/CVE-2024-55603.htmlWed, 17 Jun 2026 08:11:18 +0000MEDIUM 6.5: Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. Therefhttps://patchthecve.com/cve/CVE-2024-54001.htmlhttps://patchthecve.com/cve/CVE-2024-54001.htmlWed, 17 Jun 2026 08:09:38 +0000MEDIUM 5.5: Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflectehttps://patchthecve.com/cve/CVE-2024-36399.htmlhttps://patchthecve.com/cve/CVE-2024-36399.htmlWed, 17 Jun 2026 07:36:38 +0000HIGH 8.2: Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users tohttps://patchthecve.com/cve/CVE-2024-22720.htmlhttps://patchthecve.com/cve/CVE-2024-22720.htmlWed, 17 Jun 2026 07:11:41 +0000MEDIUM 4.8: Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature.