CVE-2023-33968: 
Linux Debian vulnerability analysis and mitigation

Kanboard, an open source project management software focusing on the Kanban methodology, was found to have a missing access control vulnerability (CVE-2023-33968) in versions prior to 1.2.30. The vulnerability was discovered and disclosed in June 2023, affecting all versions of Kanboard before version 1.2.30. The vulnerability allows users with low privileges to create or transfer tasks to any project within the software, regardless of their invitation status or project privacy settings (GitHub Advisory, NVD).

The vulnerability exists in the checkDestinationProjectValues function within /app/Model/TaskDuplicationModel.php. While the code checks if a user is allowed to move to a specified project, it only sets the owner_id to 0 when unauthorized, without preventing the code execution. The vulnerable features are 'Duplicate to project' and 'Move to project'. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (GitHub Advisory).

The vulnerability enables unauthorized users to create or transfer tasks to any project within the software, even if they haven't been invited or if the project is marked as personal. This could lead to unauthorized access to private projects and potential information disclosure (GitHub Advisory).

The vulnerability has been patched in Kanboard version 1.2.30. Users are advised to upgrade to this version or later as there are no known workarounds for this vulnerability (NVD).