CVE-2026-21880CWE-200CWE-90

Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure

Medium · published January 8, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerate all LDAP users, discover sensitive user attributes, and perform targeted attacks against specific accounts. This issue is fixed in version 1.2.49.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00396 · 32.6th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2026-01-08T00:59Z
EPSS history
Timeline
  • 08 JAN 00:59Z
    Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure
    cvelistv5