CVE-2026-25530: fallo de gravedad media en kanboard
Kanboard is missing authorization check in getSwimlane API allows cross-project data access
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.3%
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
kanboard · kanboardCVEs relacionadas — kanboard
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-55010CRITICALKanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of EventsEPSS 1.0%CVE-2024-51748CRITICALRemote code execution through language setting in kanboardEPSS 0.9%CVE-2023-36813HIGHKanboard Authenticated SQL Injections vulnerabilityEPSS 0.9%CVE-2024-51747CRITICALArbitrary File Read and Delete in kanboardEPSS 0.8%CVE-2023-33956MEDIUMParameter based Indirect Object Referencing leading to private file exposure in KanboardEPSS 0.6%CVE-2026-25924HIGHKanboard is Missing Access Control on Plugin Installation leading to Administrative RCEEPSS 0.6%