Auth bypass in Kanboard
CVE-2026-56774
Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session IDs and mass-invalidate persistent login sessions of any user, including administrators, forcing re-authentication and causing denial of service.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.005 (38.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Kanboard — versions 0, 928c68aa2b7c00092dd71084d329b912e229f3d1
Weakness classification (CWE)
References
- github.com/kanboard/kanboard/issues/5829 (technical-description, exploit)
- github.com/kanboard/kanboard/pull/5831 (issue-tracking)
- github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1 (patch)
- www.vulncheck.com/advisories/kanboard-cross-user-deletion-of-persistent-login-s… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-56774?
- CVE-2026-56774 is a medium-severity vulnerability in Kanboard, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 5.4/10. Published 2026-06-25.
- How severe is CVE-2026-56774?
- Medium severity. CVSS v3 base score is 5.4 out of 10.