Security Control Bypass in Kanboard Project Management Software

CVE-2026-25924

What is CVE-2026-25924?

A security control bypass vulnerability exists in Kanboard, a project management software tailored for the Kanban methodology. This flaw, present in versions before 1.2.50, allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application design hides the plugin installation interface when the PLUGIN_INSTALLER setting is set to false, the backend fails to enforce this security restriction properly. As a result, attackers can exploit this weakness to make the server download and install malicious plugins, leading to arbitrary code execution. The issue has been addressed in version 1.2.50.

References