What is the CVSS score of CVE-2026-25924?

CVE-2026-25924 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Kanboard are affected by CVE-2026-25924?

Kanboard versions prior to 1.2.50 contain a critical vulnerability allowing authenticated administrators to execute arbitrary code on affected systems.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25924?

Yes, a public proof-of-concept exploit is available for CVE-2026-25924. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25924?

Within 24 hours: Inventory all Kanboard instances and verify current versions; restrict administrative access to trusted personnel only. Within 7 days: Apply vendor patch to upgrade all instances to version 1.2.50 or later; validate patch deployment in a test environment first. Within 30 days: Conduct security audit of administrator accounts and access logs; review audit trails for suspicious administrative activity during the vulnerability window.

Kanboard CVE-2026-25924

HIGH

Incorrect Authorization (CWE-863)

2026-02-11 security-advisories@github.com

RCE Kanboard

8.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.4 HIGH

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 13, 2026 - 21:30 vuln.today

Public exploit code

Patch released

Feb 13, 2026 - 21:30 nvd

Patch available

CVE Published

Feb 11, 2026 - 21:16 nvd

HIGH 8.4

DescriptionGitHub Advisory

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the underlying backend endpoint fails to verify this security setting. An attacker can exploit this oversight to force the server to download and install a malicious plugin, leading to arbitrary code execution. This vulnerability is fixed in 1.2.50.

AnalysisAI

Remote code execution in Kanboard prior to 1.2.50 allows authenticated administrators to bypass plugin installation restrictions and execute arbitrary code on the server. The vulnerability stems from a configuration validation flaw where the PLUGIN_INSTALLER setting is enforced only in the UI but not validated at the backend endpoint, enabling an attacker to force installation of malicious plugins. Public exploit code exists for this vulnerability.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects the installation component of Kanboard. Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the underlying backend endpoint fails to verify this security setting. An attacker can exploit this oversight to force the server to download and