What is the CVSS score of CVE-2026-21880?

CVE-2026-21880 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of LDAP are affected by CVE-2026-21880?

Organizations using Kanboard should be aware of moderate risk from CVE-2026-21880 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21880?

Yes, a public proof-of-concept exploit is available for CVE-2026-21880. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-21880?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

LDAP CVE-2026-21880

MEDIUM

LDAP Injection (CWE-90)

2026-01-08 security-advisories@github.com

LDAP Kanboard

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 20, 2026 - 18:38 vuln.today

Public exploit code

Patch released

Jan 20, 2026 - 18:38 nvd

Patch available

CVE Published

Jan 08, 2026 - 02:15 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerate all LDAP users, discover sensitive user attributes, and perform targeted attacks against specific accounts. This issue is fixed in version 1.2.49.

AnalysisAI

Kanboard versions 1.2.48 and earlier contain an LDAP injection vulnerability where unsanitized user input in the LDAP authentication mechanism allows attackers to enumerate users, extract sensitive attributes, and target specific accounts. Public exploit code exists for this vulnerability. The issue is resolved in version 1.2.49 and later.

Technical ContextAI

Classified as CWE-90 (LDAP Injection). Affects Kanboard. Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerate all LDAP users, discover sensitive user attributes, and perform targeted attacks against specific accounts. This issue is fixed in version 1.2.49.

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 1.2.49.. Restrict network access to the affected service where possible.

More in LDAP

View all

CVE-2016-9299 CRITICAL Act Now POC

9.8 Jan 12

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a

CVE-2017-14596 CRITICAL Act Now POC

9.8 Sep 20

In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,

CVE-2017-8790 CRITICAL Act Now POC

9.8 May 05

An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi

CVE-2023-28853 MEDIUM This Month POC

6.5 Apr 04

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut

CVE-2020-36966 MEDIUM This Month POC

6.4 Jan 30

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at

CVE-2025-36556 MEDIUM This Month POC

6.1 Jan 20

A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6

CVE-2026-23906 CRITICAL Act Now

9.8 Feb 10

Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p

CVE-2026-44930 CRITICAL Act Now

9.8 May 22

Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)

CVE-2024-33868 CRITICAL Act Now

9.8 May 14

An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re

CVE-2023-6905 CRITICAL Act Now

9.8 Dec 18

A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i

CVE-2021-43350 CRITICAL Act Now

9.8 Nov 11

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P

CVE-2025-14524 MEDIUM This Month POC

5.3 Jan 08

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a s

Same weakness CWE-90 – LDAP Injection

View all

CVE-2016-9299 CRITICAL POC

9.8

CVE-2017-14596 CRITICAL POC

9.8

CVE-2017-8790 CRITICAL POC

9.8

CVE-2023-28853 MEDIUM POC

6.5

CVE-2026-44930 CRITICAL

9.8

CVE-2024-33868 CRITICAL

9.8

CVE-2023-6905 CRITICAL

9.8

CVE-2021-43350 CRITICAL

9.8

CVE-2026-21880 vulnerability details – vuln.today

Back

LDAP CVE-2026-21880

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in LDAP

Same weakness CWE-90 – LDAP Injection

Share

External POC / Exploit Code