User Role Injection Vulnerability in Kanboard by Kanboard

CVE-2026-29056

What is CVE-2026-29056?

Kanboard, a project management software that employs the Kanban methodology, is vulnerable to a user role injection due to insufficient input validation. The endpoint responsible for user invites does not properly filter POST parameters before they are processed. This flaw allows an attacker to manipulate the registration process by injecting a role parameter, specifically setting it to 'app-admin'. As a result, an ordinary user can exploit this vulnerability to create an unauthorized administrative account, thereby gaining elevated privileges in the application. It is highly recommended to update to version 1.2.51 or later, where this issue is patched.

References