CVE-2026-24885: 
NixOS vulnerability analysis and mitigation

CVE-2026-24885 is a Cross-Site Request Forgery (CSRF) vulnerability in Kanboard's ProjectPermissionController that allows unauthorized modification of project user roles. It affects all Kanboard versions prior to 1.2.50 and was disclosed on February 9–10, 2026, with a fix released in version 1.2.50. The root cause is the application's failure to strictly enforce the application/json Content-Type for the changeUserRole and changeGroupRole actions, enabling CSRF via text/plain form submissions. The vulnerability carries a CVSS v3.1 base score of 8.0 (High) per Feedly/NVD, though the GitHub advisory rates it 5.7 (Moderate) with a narrower impact scope (GitHub Advisory, Red Hat CVE).

The vulnerability (CWE-352: Cross-Site Request Forgery) exists because the changeUserRole and changeGroupRole actions in ProjectPermissionController.php lacked CSRF token validation and did not enforce application/json as the required Content-Type. Since browsers allow HTML forms to submit text/plain content cross-origin without triggering CORS preflight checks, an attacker can craft a malicious HTML form that submits a JSON-like body with enctype="text/plain" to the vulnerable endpoint. The server would parse the body as JSON and process the role change without verifying the request's legitimacy. The fix (commit 2c56d92) added checkReusableGETCSRFParam() calls, enforced isAjax() checks, and introduced strict isJsonContentType() validation in Request.php (GitHub Commit, GitHub Advisory).

Successful exploitation allows a low-privileged attacker to escalate their own project permissions (e.g., from Project Viewer to Project Manager) by tricking an authenticated admin into visiting a malicious page, without the admin's knowledge or consent. This results in unauthorized privilege escalation within Kanboard projects, potentially granting the attacker the ability to modify tasks, manage project members, or access sensitive project data. While confidentiality and availability impacts are limited, the integrity impact is high as project permission structures can be silently altered (GitHub Advisory, Red Hat CVE).

A proof-of-concept exploit is publicly available in the GitHub security advisory, demonstrating a malicious HTML form that auto-submits to the vulnerable endpoint using enctype="text/plain". Exploitation requires the attacker to have a low-privileged Kanboard account and to socially engineer an authenticated admin into visiting the malicious page. There is no evidence of in-the-wild exploitation at this time, and the EPSS score is very low at 0.014% (0.000140). The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Kanboard instance (prior to v1.2.50) and obtain a low-privileged account (e.g., Project Viewer) on a project where the attacker wants elevated permissions.
2. Identify target project and user IDs: Note the project_id and the attacker's own user_id from the Kanboard project permissions page (/project/{id}/permissions).
3. Craft malicious HTML page: Create an HTML page with a form using enctype="text/plain" that submits a JSON-like body to the changeUserRole endpoint. Example:

<form action="https://kanboard.example.com/?controller=ProjectPermissionController&action=changeUserRole&project_id=1" method="POST" enctype="text/plain">
  <input name='{"id":2,"role":"project-manager","x":"' value='"}'>
</form>
<script>document.forms[0].submit();</script>

4. Deliver to admin: Host the malicious page and trick an authenticated Kanboard admin into visiting it (e.g., via phishing email or link).
5. Role escalation achieved: The admin's browser automatically submits the forged request with their session cookies; the server processes it and upgrades the attacker's role to Project Manager without any CSRF validation (GitHub Advisory, GitHub Commit).

• Logs: Unexpected POST requests to endpoints matching ?controller=ProjectPermissionController&action=changeUserRole or changeGroupRole with a Content-Type: text/plain header in web server access logs.
• Logs: Kanboard audit logs showing sudden role changes for users (e.g., from project-viewer to project-manager) without a corresponding admin action in the UI.
• Network: HTTP POST requests to Kanboard permission endpoints originating from unexpected referrer domains or with no referrer header.
• Application: Unexplained privilege escalations for low-privileged users across one or more projects, particularly if the change timestamp correlates with an admin session.

Upgrade Kanboard to version 1.2.50 or later, which adds CSRF token validation (checkReusableGETCSRFParam()), enforces X-Requested-With: XMLHttpRequest header checks, and strictly validates application/json Content-Type for role-change endpoints. As a temporary workaround prior to patching, admins should avoid visiting untrusted websites while authenticated to Kanboard, and consider implementing a WAF rule to reject POST requests to permission endpoints with non-JSON Content-Type headers. Additionally, audit recent project permission changes to identify any unauthorized modifications (GitHub Release, GitHub Commit).

The vulnerability was reported by security researcher sumeet-darekar and credited in the GitHub advisory. The Kanboard maintainer (fguillot) published the advisory and patch on February 8–9, 2026. Red Hat tracked the CVE as part of their security monitoring. No significant broader media coverage or notable community debate has been identified beyond the standard vulnerability disclosure channels (GitHub Advisory, Red Hat CVE).