CVE-2024-55603

Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. Therefore, when a `session_id` is given, kanboard queries the data from the `sessions` sql table. At this point, it does not correctly verify, if a given `session_id` has already exceeded its lifetime (`expires_at`). Thus, a session which's lifetime is already `> time()`, is still queried from the database and hence a valid login. The implemented **SessionHandlerInterface::gc** function, that does remove invalid sessions, is called only **with a certain probability** (_Cleans up expired sessions. Called by `session_start()`, based on `session.gc_divisor`, `session.gc_probability` and `session.gc_maxlifetime` settings_) accordingly to the php documentation. In the official Kanboard docker image these values default to: session.gc_probability=1, session.gc_divisor=1000. Thus, an expired session is only terminated with probability 1/1000. This issue has been addressed in release 1.2.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-613

• https://github.com/kanboard/kanboard/blob/main/app/Core/Session/SessionHandler.php#L40Product
• https://github.com/kanboard/kanboard/commit/7ce61c34d962ca8b5dce776289ddf4b207be6e78Patch
• https://github.com/kanboard/kanboard/security/advisories/GHSA-gv5c-8pxr-p484Exploit, Vendor Advisory
• https://www.php.net/manual/en/function.session-start.phpProduct
• https://www.php.net/manual/en/session.configuration.php#ini.session.gc-divisorProduct
• https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetimeProduct
• https://www.php.net/manual/en/session.configuration.php#ini.session.gc-probabilityProduct
• https://www.php.net/manual/en/sessionhandlerinterface.gc.phpProduct

Published

Dec 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55595Rejected reason: Not used
• CVE-2024-55597A improper limitation of a pathname to a restricted director…7.2
• CVE-2024-55599An Improperly Implemented Security Check for Standard vulner…5.3
• CVE-2024-5560CWE-125: Out-of-bounds Read vulnerability exists that could …7.5
• CVE-2024-55601Hugo is a static site generator. Starting in version 0.123.0…5.3
• CVE-2024-55602PwnDoc is a penetration test report generator. Prior to comm…8.5
• CVE-2024-55604Appsmith is a platform to build admin panels, internal tools…4.3
• CVE-2024-55605Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-5561The Popup Maker WordPress plugin before 1.19.1 does not san…4.8
• CVE-2024-55626Suricata is a network Intrusion Detection System, Intrusion …5.5
• CVE-2024-55627Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-55628Suricata is a network Intrusion Detection System, Intrusion …7.5