CVE-2026-32255

Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).

• CWE-918

• https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7Patch
• https://github.com/kanbn/kan/releases/tag/v0.5.5Product, Release Notes
• https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqgMitigation, Patch, Vendor Advisory

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3225The LearnPress – WordPress LMS Plugin plugin for WordPress i…4.3
• CVE-2026-32250NamelessMC is website software for Minecraft servers. A Refl…4.3
• CVE-2026-32251Tolgee is an open-source localization platform. Prior to 3.1…6.5
• CVE-2026-32252Chartbrew is an open-source web application that can connect…7.7
• CVE-2026-32253Sunshine is a self-hosted game stream host for Moonlight. In…9.8
• CVE-2026-32254Kube-router is a turnkey solution for Kubernetes networking.…7.1
• CVE-2026-32256music-metadata is a metadata parser for audio and video medi…7.5
• CVE-2026-32259ImageMagick is free and open-source software used for editin…6.7
• CVE-2026-3226The LearnPress – WordPress LMS Plugin plugin for WordPress i…4.3
• CVE-2026-32260Deno is a JavaScript, TypeScript, and WebAssembly runtime. F…9.8
• CVE-2026-32261Webhooks for Craft CMS plugin adds the ability to manage “we…8.5
• CVE-2026-32262Craft CMS is a content management system (CMS). From version…4.3