CVE-2026-25924

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the underlying backend endpoint fails to verify this security setting. An attacker can exploit this oversight to force the server to download and install a malicious plugin, leading to arbitrary code execution. This vulnerability is fixed in 1.2.50.

• CWE-863

• https://github.com/kanboard/kanboard/commit/b9ada89b1a64034612fc4262b88c42458c0d6ee4Patch
• https://github.com/kanboard/kanboard/releases/tag/v1.2.50Product, Release Notes
• https://github.com/kanboard/kanboard/security/advisories/GHSA-grch-p7vf-vc4fExploit, Mitigation, Vendor Advisory

Published

Feb 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25918unity-cli is a command line utility for the Unity Game Engin…5.5
• CVE-2026-2592The Zarinpal Gateway for WooCommerce plugin for WordPress is…7.7
• CVE-2026-25920SumatraPDF is a multi-format reader for Windows. In 3.5.2 an…5.5
• CVE-2026-25921Gogs is an open source self-hosted Git service. Prior to ver…9.3
• CVE-2026-25922authentik is an open-source identity provider. Prior to 2025…8.8
• CVE-2026-25923my little forum is a PHP and MySQL based internet forum that…9.1
• CVE-2026-25925PowerDocu contains a Windows GUI executable to perform techn…7.8
• CVE-2026-25926Notepad++ is a free and open-source source code editor. An U…7.3
• CVE-2026-25927OpenEMR is a free and open source electronic health records …7.1
• CVE-2026-25928OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25929OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-2593The Greenshift – animation and page builder blocks plugin fo…6.4