CVE-2026-24885

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.50

Description Kanboard is project management software. A Cross-Site Request Forgery (CSRF) issue exists in the ProjectPermissionController. The application does not strictly enforce the application/json Content-Type for the changeUserRole action, accepting text/plain instead. This allows an attacker to craft a malicious form and potentially modify project user roles if an authenticated administrator visits a malicious site. The vulnerable action is changeUserRole.

Recommendations Update to version 1.2.50 or later.