Which versions of Kanboard are affected by CVE-2026-58660?

Kanboard through version 1.2.52 contains a broken authorization flaw enabling any project member to modify or delete tasks across unrelated projects-including those restricted to others-and publicly…. A patch is available.

Is there a public PoC exploit available for CVE-2026-58660?

Yes, a public proof-of-concept exploit is available for CVE-2026-58660. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-58660?

Within 24 hours, identify all Kanboard instances in production and confirm their versions. Within 7 days, apply the vendor patch (commit 564cc30 or later) to all systems running version 1.2.52 or earlier. Within 30 days, audit task and project modification logs for any unauthorized cross-project changes indicating prior exploitation.

Kanboard CVE-2026-58660

Q: What is the CVSS score of CVE-2026-58660?

CVE-2026-58660 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-44752 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-15 VulnCheck

GHSA-f95x-r3pv-jh63

Authentication Bypass Kanboard

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 17:47 vuln.today

Analysis Generated

Jul 15, 2026 - 17:47 vuln.today

CVE Published

Jul 15, 2026 - 17:03 cve.org

HIGH 7.2

DescriptionCVE.org

Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.

AnalysisAI

Broken object-level authorization in Kanboard through 1.2.52 lets any authenticated user who belongs to at least one project move, corrupt, or hide tasks in any other project on the same instance, including private projects they have no role on. The BoardAjaxController save() drag-and-drop endpoint checks the caller's role against the attacker-supplied project_id but never confirms the supplied task_id belongs to that project, and because task IDs are sequential integers shared instance-wide they are trivially enumerable. Publicly available exploit code exists and a vendor patch (commit 564cc30) is available, but this is not listed in CISA KEV and there is no public exploit identified as actively exploited in the wild.