CVE-2026-58660
Deferred Deferred - Pending Action

Stored Task Manipulation in Kanboard

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: VulnCheck

Description
Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-08-05
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-03
NVD
CVE-2026-58660
EUVD
EUVD-2026-44752

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kanboard kanboard to 1.2.52 (inc)
kanboard kanboard to 1.2.52 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kanboard through 1.2.52 has a vulnerability where the drag-and-drop endpoint for kanban boards does not verify if a task being moved belongs to the specified project. Task IDs are sequential and shared across the entire instance, allowing any authenticated project member to move tasks from other projects, including private ones they have no access to. This can hide or corrupt tasks in unauthorized projects.

Detection Guidance

To detect this vulnerability, check Kanboard logs for suspicious drag-and-drop actions or task movements between projects. Look for requests to the BoardAjaxController save endpoint with mismatched project and task IDs. No specific commands are provided in the context.

Impact Analysis

If you use Kanboard, an attacker with basic project membership could move, hide, or corrupt tasks in projects they don't belong to. This could disrupt workflows, hide important tasks, or cause data integrity issues by making tasks disappear from their legitimate projects.

Compliance Impact

This vulnerability could lead to unauthorized access or manipulation of sensitive data, violating compliance requirements for data integrity and access control. GDPR and HIPAA require strict access controls and data protection; unauthorized task movement could result in non-compliance, data breaches, or loss of audit integrity.

Mitigation Strategies
  • Upgrade Kanboard to the latest version where the fix is applied (commit 564cc30 or later).
  • Review and audit task movements in project logs to identify unauthorized changes.
  • Restrict project membership to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58660. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart