by Kastro
Paper/Archive/CVE-2026-21881

CVE-2026-21881

kanboard kanboard — Kanboard is Vulnerable to Reverse Proxy Authentication Bypass

EPSS 0.5%public exploitCVSS 9.1
critical.is priorityof 100
46
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 41.9.419 × 208.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.

Affected

ProductAffectedFixed inSource
kanboard< 1.2.49–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/kanboard/kanboard/security/advisories/GHSA-wwpf-3j4p-739wrefgithub.com/kanboard/kanboard/commit/7af6143e2ad25b5c15549cca8af4341c7ac4e2fcrefgithub.com/kanboard/kanboard/releases/tag/v1.2.49