EUVD-2026-39526
GHSA-vvjm-mjq4-27c8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires a low-privilege authenticated account (PR:L); no confidentiality impact; session deletion yields minor integrity and availability degradation only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session IDs and mass-invalidate persistent login sessions of any user, including administrators, forcing re-authentication and causing denial of service.
AnalysisAI
Authenticated session hijacking via IDOR in Kanboard through 1.2.52 allows any low-privilege user to mass-invalidate the persistent 'Remember Me' sessions of arbitrary users, including administrators, by enumerating sequential integer session IDs against the unguarded removeSession endpoint. The root-cause fix - scoping RememberMeSessionModel::remove() to the requesting user's own user_id - is confirmed in commit 928c68a via PR #5831. A publicly available proof-of-concept exists on GitHub (issue #5829); this vulnerability is not currently listed in the CISA KEV catalog, though the trivially low exploitation barrier warrants prompt patching.
Technical ContextAI
Kanboard is a PHP-based open-source project management application (CPE: cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*). The vulnerability resides in UserViewController::removeSession(), which accepted an attacker-controlled integer id parameter and passed it directly to RememberMeSessionModel::remove($session_id) without verifying session ownership. CWE-639 (Authorization Bypass Through User-Controlled Key) precisely characterizes the flaw: the session ID is an enumerable sequential integer serving as a direct object reference with no access control validation. The PR diff confirms the fix adds a mandatory $user_id parameter to remove() and appends ->eq('user_id', $user_id) to the database query, scoping deletions to the authenticated user's own sessions. A parallel fix was applied to AuthSubscriber::afterLogout(). The 'Remember Me' subsystem stores persistent browser tokens; their deletion forces re-authentication but does not expose token values.
RemediationAI
Update Kanboard to a build that includes commit 928c68aa2b7c00092dd71084d329b912e229f3d1 (PR #5831, https://github.com/kanboard/kanboard/pull/5831); self-hosted instances should pull from the patched HEAD or await a tagged release from the vendor. If immediate patching is not feasible, restrict the removeSession endpoint at the web server or reverse-proxy level to prevent requests where the session id parameter does not correspond to the authenticated user - this requires WAF or middleware capability and may break legitimate session management. As an operational control, disable the 'Remember Me' feature entirely via Kanboard's application settings to eliminate persistent sessions as an attack surface; this degrades user experience by requiring re-authentication on every visit. Monitor application logs for high-frequency requests to the session removal endpoint from a single authenticated user, which is a reliable indicator of enumeration attempts.
Kanboard project management (through 1.2.48) has an authentication bypass when REVERSE_PROXY_AUTH is enabled. The applic
Kanboard is project management software that focuses on the Kanban methodology. Rated high severity (CVSS 8.8), this vul
Remote code execution in Kanboard prior to 1.2.50 allows authenticated administrators to bypass plugin installation rest
Kanboard prior to version 1.2.46 contains a host header injection vulnerability that allows unauthenticated attackers to
Broken object-level authorization in Kanboard through 1.2.52 lets any authenticated user who belongs to at least one pro
Kanboard is project management software that focuses on the Kanban methodology. Rated high severity (CVSS 7.2), this vul
Kanboard is project management software that focuses on the Kanban methodology. Rated high severity (CVSS 7.2), this vul
Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack the authentic
Kanboard is project management software that focuses on the Kanban methodology. Rated medium severity (CVSS 6.5), this v
Kanboard is open source project management software that focuses on the Kanban methodology. Rated medium severity (CVSS
Kanboard is open source project management software that focuses on the Kanban methodology. Rated medium severity (CVSS
Kanboard is project management software that focuses on the Kanban methodology. Rated medium severity (CVSS 6.3), this v
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today