CVE-2026-24885

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although the request body is JSON, the server accepts text/plain, allowing an attacker to craft a malicious form using the text/plain attribute. Which allows unauthorized modification of project user roles if an authenticated admin visits a malicious site This vulnerability is fixed in 1.2.50.

• CWE-352

• https://github.com/kanboard/kanboard/commit/2c56d92783d4a3094812c2f7cba50f80a372f95ePatch
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50Product, Release Notes
• https://github.com/kanboard/kanboard/security/advisories/GHSA-582j-h4w4-hwr5Exploit, Vendor Advisory
• https://github.com/kanboard/kanboard/security/advisories/GHSA-582j-h4w4-hwr5Exploit, Vendor Advisory

Published

Feb 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2488The ProfileGrid – User Profiles, Groups and Communities plug…4.3
• CVE-2026-24880Inconsistent Interpretation of HTTP Requests ('HTTP Request/…7.5
• CVE-2026-24881In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData…9.8
• CVE-2026-24882In GnuPG before 2.5.17, a stack-based buffer overflow exists…7.8
• CVE-2026-24883In GnuPG before 2.5.17, a long signature packet length cause…5.5
• CVE-2026-24884Compressing is a compressing and uncompressing lib for node.…7.8
• CVE-2026-24887Claude Code is an agentic coding tool. Prior to version 2.0.…8.8
• CVE-2026-24888Maker.js is a 2D vector line drawing and shape modeling for …9.8
• CVE-2026-24889soroban-sdk is a Rust SDK for Soroban contracts. Arithmetic …5.3
• CVE-2026-2489The TP2WP Importer plugin for WordPress is vulnerable to Sto…4.4
• CVE-2026-24890OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-24891openITCOCKPIT is an open source monitoring tool built for di…7.5