CVE-2026-25531

4.3 mediumEPSS 0.3%

Medium (4.3) in kanboard kanboard. EPSS 0.3% chance of exploitation in the next 30 days.

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to duplicate tasks into projects they cannot access. This vulnerability is fixed in 1.2.50.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-02-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

kanboard:kanboard

References

https://github.com/kanboard/kanboard/commit/df7b7a21ee071f36466d8b38e40d0b0b8b8d394d
https://github.com/kanboard/kanboard/releases/tag/v1.2.50
https://github.com/kanboard/kanboard/security/advisories/GHSA-vrm3-3337-whp9

Check your stack JSON