What is the CVSS score of CVE-2026-33058?

CVE-2026-33058 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by CVE-2026-33058?

Kanboard versions prior to 1.2.51 contain an authenticated SQL injection vulnerability that could allow project managers or users with project administration rights to extract the entire database,…. A patch is available.

How to fix or mitigate CVE-2026-33058?

Within 24 hours: Identify all Kanboard instances in your environment and document their versions; restrict project administrator roles to only essential personnel and audit current role assignments. Within 7 days: Implement network segmentation to limit Kanboard database access; deploy WAF rules to detect SQL injection patterns in user input fields; enable comprehensive logging and monitoring of database queries. Within 30 days: Upgrade to Kanboard version 1.2.51 or later as soon as the patch is available; conduct a forensic audit of database access logs to detect any unauthorized access; review and remediate any exposed credentials discovered during the audit.

Ubuntu CVE-2026-33058

EUVD-2026-12759 MEDIUM

SQL Injection (CWE-89)

2026-03-18 GitHub_M

SQLi Ubuntu Debian Kanboard

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 03:30 euvd

EUVD-2026-12759

Analysis Generated

Mar 18, 2026 - 03:30 vuln.today

CVE Published

Mar 18, 2026 - 02:17 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51 fixes the issue.

AnalysisAI

An authenticated SQL injection vulnerability exists in Kanboard project management software prior to version 1.2.51. Authenticated attackers with permission to add users to a project can exploit this vulnerability to dump the entire Kanboard database, potentially exposing sensitive project data, user credentials, and application secrets. The vulnerability is confirmed under active tracking by Debian (2 releases) and Ubuntu (medium priority), with a GitHub Security Advisory published.

Technical ContextAI

Kanboard (cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*) is a web-based Kanban project management application written in PHP. This vulnerability is classified as CWE-89 (SQL Injection), indicating insufficient input validation or parameterization in database queries related to the user-to-project assignment functionality. The CVSS 4.0 vector indicates network-based exploitation (AV:N) with low attack complexity (AC:L) and no attack requirements (AT:N), requiring only low privileges (PR:L) such as a standard authenticated user account with project user management permissions. The vulnerability allows attackers to manipulate SQL queries to extract arbitrary data from the database backend.

RemediationAI

Upgrade Kanboard to version 1.2.51 or later, which contains a fix for this SQL injection vulnerability as documented in the GitHub Security Advisory at https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhh. Organizations using Debian or Ubuntu should monitor their respective security channels for patched packages. Until patching is completed, implement compensating controls by restricting which authenticated users have permission to add users to projects, limiting this capability only to highly trusted administrators. Consider implementing database activity monitoring to detect SQL injection attempts targeting user management functions, and review application logs for suspicious queries or abnormal database access patterns.