CVE-2026-56774

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.53

Description Authenticated users can delete the Remember Me sessions of other users, including administrators, because the UserViewController::removeSession function fails to validate the session id parameter before passing it to RememberMeSessionModel::remove. This allows an attacker to enumerate sequential session IDs and mass-invalidate persistent login sessions, forcing users to re-authenticate and resulting in a denial of service.

Recommendations Update Kanboard to version 1.2.53 or later.