Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:NSummary
CVE-2026-24885 is a medium-severity CSRF (CWE-352) vulnerability in Kanboard Kanboard. Its CVSS base score is 5.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Kanboard, an open-source project management tool based on the Kanban methodology, contains a Cross-Site Request Forgery (CSRF) vulnerability designated as CVE-2026-24885 in versions prior to 1.2.50. The issue resides in the ProjectPermissionController, specifically the changeUserRole action, where the server does not strictly enforce an application/json Content-Type header. Despite expecting JSON in the request body, it accepts text/plain payloads, enabling attackers to submit malicious data via HTML forms.
An attacker can exploit this vulnerability by hosting a malicious webpage with a form configured to use text/plain Content-Type, tricking an authenticated administrator into visiting the site. Upon submission—triggered by user interaction such as clicking a button—the forged request modifies project user roles without the admin's knowledge or consent. The CVSS v3.1 base score of 5.7 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) reflects network accessibility, low attack complexity, requirement for low-privileged authentication (via the victim's session), and user interaction, resulting in high integrity impact through unauthorized role changes.
The vulnerability is addressed in Kanboard version 1.2.50, as detailed in the project's security advisory (GHSA-582j-h4w4-hwr5), release notes, and the fixing commit (2c56d92783d4a3094812c2f7cba50f80a372f95e). Security practitioners should urge users to upgrade immediately to mitigate risks, aligning with CWE-352 guidance on CSRF prevention.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6458
Vulnerability Data
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although…
more
the request body is JSON, the server accepts text/plain, allowing an attacker to craft a malicious form using the text/plain attribute. Which allows unauthorized modification of project user roles if an authenticated admin visits a malicious site This vulnerability is fixed in 1.2.50.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement requires verifying that state-changing requests originate from the authenticated user rather than a forged cross-site source.
Protecting session authenticity prevents attackers from replaying or forging authenticated requests via the victim's browser.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.