CVE-2026-25531CWE-862

Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects

Medium · published February 13, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
32.0
In the wild
Unconfirmed
What it is

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to duplicate tasks into projects they cannot access. This vulnerability is fixed in 1.2.50.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00390 · 32.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-13T15:04Z
EPSS history
Timeline
  • 13 FEB 15:04Z
    Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects
    cvelistv5