CVE-2026-33058CWE-89

Kanboard has Authenticated SQL Injection in Project Permissions Handler

High · published March 18, 2026

CVSS v4.0
8.4
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51 fixes the issue.

The record
Technical detail
CVSS v4.0
8.4 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-18T02:17Z
EPSS history
Timeline
  • 18 MAR 02:17Z
    Kanboard has Authenticated SQL Injection in Project Permissions Handler
    cvelistv5