CVE-2026-25924
Security Bypass in Kanboard Plugin Installer Enables Remote Code Execution
Publication date: 2026-02-11
Last updated on: 2026-02-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kanboard | kanboard | to 1.2.50 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-25924 is a security vulnerability in Kanboard project management software versions up to 1.2.49. It involves a security control bypass that allows an authenticated administrator to perform full Remote Code Execution (RCE). Although the user interface hides the plugin installation option when the PLUGIN_INSTALLER configuration is set to false, the backend endpoint responsible for plugin installation does not verify this setting. This flaw allows an attacker with administrator access to force the server to download and install a malicious plugin, which then executes arbitrary code on the server.
The vulnerability stems from missing access control checks in the plugin installation methods, specifically the install() method in the PluginController, which does not verify whether plugin installation is enabled. This enables an attacker to bypass intended restrictions by directly invoking the plugin installation endpoint with a valid CSRF token and a malicious plugin URL.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including full administrative Remote Code Execution on the affected server. An attacker can execute arbitrary system commands, read and write any files such as sensitive configuration files, access and dump the entire database, pivot to internal networks, and maintain persistent access through web or reverse shells.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by monitoring for unauthorized or suspicious plugin installation attempts on Kanboard instances, especially those targeting the plugin installation endpoint with parameters like 'archive_url' and valid CSRF tokens."}, {'type': 'paragraph', 'content': "Since the vulnerability involves an authenticated administrator bypassing the PLUGIN_INSTALLER restriction to install plugins remotely, detection can focus on HTTP requests to the PluginController's install action."}, {'type': 'paragraph', 'content': "Suggested commands include inspecting web server logs or using network monitoring tools to filter requests containing the 'archive_url' parameter targeting the PluginController install endpoint."}, {'type': 'list_item', 'content': "Example command to search web server logs for suspicious plugin installation attempts: grep 'PluginController&action=install' /var/log/nginx/access.log"}, {'type': 'list_item', 'content': "Look for requests with 'archive_url' parameter indicating plugin installation from external URLs."}, {'type': 'list_item', 'content': 'Monitor for unexpected POST requests with valid CSRF tokens to the plugin install endpoint.'}, {'type': 'paragraph', 'content': 'Additionally, reviewing Kanboard versions in use can help detect vulnerable instances; versions prior to 1.2.50 are affected.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade Kanboard to version 1.2.50 or later, where the vulnerability is fixed by enforcing access control checks on plugin installation actions.
If upgrading immediately is not possible, ensure that the PLUGIN_INSTALLER configuration constant is set to false to disable plugin installation.
Restrict access to the plugin installation endpoints to trusted administrators only and monitor for any unauthorized access attempts.
Apply network-level controls such as firewall rules to limit access to the Kanboard administrative interface.
Review and revoke any suspicious administrator sessions or credentials that may have been compromised.