CVE-2026-25530: 
NixOS vulnerability analysis and mitigation

CVE-2026-25530 is a missing authorization vulnerability in Kanboard's getSwimlane API method that allows authenticated users to access swimlane data from projects they are not permitted to access. It affects all Kanboard versions up to and including 1.2.49, and was fixed in version 1.2.50. The vulnerability was published on February 10, 2026, with the security advisory authored by maintainer fguillot and credited to reporter s2ongmo. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Feedly).

The root cause is an Insecure Direct Object Reference / Authorization Bypass Through User-Controlled Key (CWE-639) in app/Api/Procedure/SwimlaneProcedure.php. The getSwimlane($swimlane_id) method directly fetched swimlane records by ID without invoking ProjectAuthorization::check(), unlike analogous methods such as getCategory, getColumn, and getComment which all include proper authorization checks. An authenticated attacker can exploit this by sending a JSON-RPC API request with an arbitrary swimlane_id value to /jsonrpc.php, bypassing project-level access controls entirely. The fix, applied in commit c3d8d20, adds a ProjectAuthorization check after fetching the swimlane record, using the swimlane's own project_id field to enforce access control (GitHub Advisory, GitHub Commit).

Successful exploitation allows an authenticated but low-privileged user to read swimlane metadata — including name, description, and associated project_id — from any project on the Kanboard instance, regardless of their assigned project permissions. This constitutes a confidentiality breach across project boundaries, potentially exposing sensitive project structure information and confirming the existence of otherwise inaccessible projects. There is no integrity or availability impact, and lateral movement beyond information disclosure is not directly enabled by this vulnerability alone (GitHub Advisory).

A public proof-of-concept is included in the official GitHub Security Advisory, demonstrating exploitation via a simple curl command against the /jsonrpc.php endpoint. The EPSS score is 0.025% (very low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion as of the time of reporting. No threat actor attribution has been identified (GitHub Advisory, Feedly).

1. Authenticate: Obtain valid credentials for any low-privileged Kanboard user account.
2. Confirm access restriction: Verify that the target project (e.g., project ID 3) is inaccessible to the attacker's account by calling getProjectById:

   curl -sS -u testuser:pass -H 'Content-Type: application/json' \
     -d '{"jsonrpc":"2.0","method":"getProjectById","id":1,"params":[3]}' \
     http://target/jsonrpc.php

   Expected response: {"error":{"code":403,"message":"Forbidden"}}
3. Enumerate swimlane IDs: Guess or enumerate integer swimlane IDs (e.g., starting from 1 upward).
4. Call the vulnerable API method: Send a getSwimlane request with the target swimlane ID:

   curl -sS -u testuser:pass -H 'Content-Type: application/json' \
     -d '{"jsonrpc":"2.0","method":"getSwimlane","id":1,"params":[5]}' \
     http://target/jsonrpc.php

5. Retrieve restricted data: The response returns swimlane metadata including name, description, and project_id, confirming unauthorized cross-project data access (GitHub Advisory).

• Network: Repeated JSON-RPC POST requests to /jsonrpc.php with method: getSwimlane and sequentially or randomly varying swimlane_id parameters from a single authenticated user.
• Logs: Web server access logs showing multiple POST /jsonrpc.php requests from the same user/IP with different swimlane IDs, especially for swimlanes belonging to projects the user is not a member of.
• Application Behavior: Successful getSwimlane API responses returning project_id values that do not correspond to projects the requesting user has access to (detectable via application-level audit logging if enabled).

Upgrade Kanboard to version 1.2.50 or later, which adds the missing ProjectAuthorization check to the getSwimlane API method and also addresses similar missing authorization issues in ProjectFileProcedure, TaskExternalLinkProcedure, TaskProcedure, and TaskTagProcedure. No configuration-based workaround is available; upgrading is the only remediation. Organizations unable to upgrade immediately should consider restricting API access to trusted networks or disabling API access entirely until patching is feasible (GitHub Release, GitHub Commit).