What is the CVSS score of CVE-2026-21881?

CVE-2026-21881 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Kanboard are affected by CVE-2026-21881?

Organizations using Kanboard face critical risk from CVE-2026-21881, a improper authentication vulnerability rated CVSS 9.1.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21881?

Yes, a public proof-of-concept exploit is available for CVE-2026-21881. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-21881?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Audit authentication configurations and rotate any potentially compromised credentials.

Kanboard CVE-2026-21881

CRITICAL

Improper Authentication (CWE-287)

2026-01-08 security-advisories@github.com

Authentication Bypass Kanboard

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 20, 2026 - 15:57 vuln.today

Public exploit code

Patch released

Jan 20, 2026 - 15:57 nvd

Patch available

CVE Published

Jan 08, 2026 - 02:15 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.

AnalysisAI

Kanboard project management (through 1.2.48) has an authentication bypass when REVERSE_PROXY_AUTH is enabled. The application trusts HTTP headers for authentication without verifying the request came from the reverse proxy. Any attacker can impersonate any user including admins. PoC available, patch available.

Technical ContextAI

When REVERSE_PROXY_AUTH is configured, Kanboard reads username from an HTTP header (typically X-Forwarded-User) without verifying that the request actually came through the trusted reverse proxy (CWE-287). Any client can set this header directly, impersonating any user.

RemediationAI

Update to the patched version. Ensure Kanboard is only accessible through the reverse proxy (block direct access). Verify proxy configuration forwards proper headers.