Authorization Bypass in Kan Project Management Tool by Kan

CVE-2026-92802

What is CVE-2026-92802?

The Kan project management tool, up to version 0.6.0, is vulnerable to an authorization bypass due to improper validation of board creation permissions within the GitHub project import endpoint. This flaw allows unauthorized guests to create boards, even without the necessary 'board:create' permissions typically required. Attackers can exploit this vulnerability by using the importProjects mutation, managing to bypass standard authorization checks that would otherwise prevent direct board creation.

References