Cyber Resilience

CVE-2026-29056

Kanboard ≤ 1.2.51

Public PoC
Published
18 March 2026
Modified
18 March 2026
Patch / advisory
CVSS Score v4 7.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0037 30th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-29056 is a high-severity Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) vulnerability in Kanboard Kanboard. Its CVSS base score is 7.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-29056 is a high-severity vulnerability (CVSS 8.8) in Kanboard, an open-source project management software focused on the Kanban methodology. The issue affects versions prior to 1.2.51 and stems from the user invite registration endpoint in UserInviteController::register(), which accepts all POST parameters without filtering and passes them directly to UserModel::create(). This allows unvalidated input, including the "role" field, to be processed, mapped to CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes).

An attacker with access to a valid invite link—requiring low privileges (PR:L) as per the CVSS vector—can exploit this over the network (AV:N) with low complexity and no user interaction (UI:N). By injecting the parameter "role=app-admin" into the registration form, the attacker creates a new account with administrator privileges, gaining high-impact access to confidentiality (C:H), integrity (I:H), and availability (A:H) controls without scope changes (S:U).

The GitHub Security Advisory (GHSA-2jvj-q44v-6p3x) confirms that Kanboard version 1.2.51 resolves the vulnerability by implementing proper filtering of the role field in the registration process. Security practitioners should prioritize upgrading affected Kanboard instances to 1.2.51 or later and review any existing invite links for potential exposure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field. An attacker who receives an invite link…

more

can inject `role=app-admin` in the registration form to create an administrator account. Version 1.2.51 fixes the issue.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1098 Account Manipulation Persistence
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
T1098.001 Additional Cloud Credentials Persistence
Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
T1098.003 Additional Cloud Roles Persistence
An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant.
T1098.004 SSH Authorized Keys Persistence
Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-25531Same product: Kanboard Kanboard
CVE-2023-33968Same product: Kanboard Kanboard
CVE-2023-33970Same product: Kanboard Kanboard
CVE-2026-25924Same product: Kanboard Kanboard
CVE-2026-33058Same product: Kanboard Kanboard
CVE-2024-51747Same product: Kanboard Kanboard
CVE-2026-24885Same product: Kanboard Kanboard
CVE-2023-36813Same product: Kanboard Kanboard
CVE-2025-55011Same product: Kanboard Kanboard
CVE-2026-21881Same product: Kanboard Kanboard

Affected Assets

kanboard
kanboard
≤ 1.2.51

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Enforces authorizations so that only permitted attributes may be modified on an object.

Limits the set of modifiable attributes a subject is authorized to touch.

Validates incoming attribute names and values so that only explicitly allowed fields are accepted for update.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require allow-listing of mutable object attributes and input validation to block mass-assignment flaws.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure coding standards explicitly forbid unsafe dynamic attribute assignment and require property allow-lists.

finds

Security testing can detect mass-assignment flaws but does not itself prevent them at runtime.

prevents

Secure development lifecycle requires input validation and object-property whitelisting that directly mitigates mass-assignment risks.

prevents

Application security requirements include explicit rules for allowable object attributes and safe deserialization.

prevents

Secure architecture principles mandate strict control over dynamic object modification and attribute binding.

prevents

Information access restriction limits who can modify objects but does not address which attributes may be changed.

References