CVE-2026-21880

5.3 mediumEPSS 0.4%

Medium (5.3) in kanboard kanboard. EPSS 0.4% chance of exploitation in the next 30 days.

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerate all LDAP users, discover sensitive user attributes, and perform targeted attacks against specific accounts. This issue is fixed in version 1.2.49.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWEs: CWE-90, CWE-200
Published: 2026-01-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

kanboard:kanboard

References

https://github.com/kanboard/kanboard/commit/dd374079f7c2d1dab74c1680960e684ff8668586
https://github.com/kanboard/kanboard/releases/tag/v1.2.49
https://github.com/kanboard/kanboard/security/advisories/GHSA-v66r-m28r-wmq7
https://github.com/kanboard/kanboard/security/advisories/GHSA-v66r-m28r-wmq7

Check your stack JSON