CVE-2026-29056

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-29056
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29056.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-29056
Aliases
  • GHSA-2jvj-q44v-6p3x
Downstream
Published
2026-03-18T01:56:19.315Z
Modified
2026-07-08T08:00:00.494463018Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:N/SA:N/E:P CVSS Calculator
Summary
Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin
Details

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (UserInviteController::register()) accepts all POST parameters and passes them to UserModel::create() without filtering out the role field. An attacker who receives an invite link can inject role=app-admin in the registration form to create an administrator account. Version 1.2.51 fixes the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-915"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29056.json"
}
References

Affected packages

Git / github.com/kanboard/kanboard

Affected ranges

Type
GIT
Repo
https://github.com/kanboard/kanboard
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1c27f48cc2ef2bfbf6097c5ec19e61d1aa60dba6
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.51"
        }
    ],
    "cpe": "cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.15
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.0.2
v1.0.20
v1.0.26
v1.0.27
v1.0.28
v1.0.29
v1.0.3
v1.0.30
v1.0.31
v1.0.32
v1.0.33
v1.0.34
v1.0.35
v1.0.36
v1.0.37
v1.0.38
v1.0.39
v1.0.4
v1.0.40
v1.0.41
v1.0.42
v1.0.43
v1.0.44
v1.0.45
v1.0.46
v1.0.48
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.2.0
v1.2.1
v1.2.10
v1.2.11
v1.2.12
v1.2.13
v1.2.14
v1.2.15
v1.2.16
v1.2.17
v1.2.18
v1.2.19
v1.2.2
v1.2.20
v1.2.21
v1.2.22
v1.2.23
v1.2.24
v1.2.25
v1.2.26
v1.2.27
v1.2.28
v1.2.29
v1.2.3
v1.2.30
v1.2.31
v1.2.32
v1.2.33
v1.2.34
v1.2.35
v1.2.36
v1.2.37
v1.2.38
v1.2.39
v1.2.4
v1.2.40
v1.2.41
v1.2.42
v1.2.43
v1.2.44
v1.2.45
v1.2.46
v1.2.47
v1.2.49
v1.2.5
v1.2.50
v1.2.6
v1.2.7
v1.2.8
v1.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29056.json"