CVE-2026-25531: 
NixOS vulnerability analysis and mitigation

CVE-2026-25531 is a missing authorization vulnerability in Kanboard, an open-source project management application focused on Kanban methodology. It represents an incomplete fix for CVE-2023-33968 (GHSA-gf8r-4p6m-v8vr): the TaskCreationController::duplicateProjects() endpoint fails to validate user permissions for target projects, allowing authenticated users to duplicate tasks into projects they are not authorized to access. All Kanboard versions up to and including 1.2.49 are affected; the issue is resolved in version 1.2.50. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause is CWE-862 (Missing Authorization): the duplicateProjects() method in app/Controller/TaskCreationController.php iterates over a list of target project_ids supplied by the user and calls taskProjectDuplicationModel->duplicateToProject() for each, without first checking whether the authenticated user has permission to access those target projects (GitHub Advisory). The same class of missing check was also found in ProjectActionDuplicationController and ProjectCreationController, all patched in the same commit (GitHub Commit). Exploitation requires only a valid authenticated session and a crafted HTTP POST request; no elevated privileges or user interaction are needed beyond basic login.

An authenticated attacker with low privileges can inject tasks into any project on the Kanboard instance, regardless of project-level access controls, violating project boundaries and data integrity. The impact is limited to integrity — the attacker cannot read data from the target project (confidentiality is unaffected) and availability is not impacted. However, unauthorized task injection can corrupt project workflows, introduce misleading data, and potentially expose task metadata to project members who later view the injected tasks (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating the full attack flow against Kanboard v1.2.49 (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.025% (0.000250), reflecting low probability of near-term exploitation (Feedly). The vulnerability was reported by researcher s2ongmo and disclosed on February 9, 2026.

1. Authenticate: Log in to the target Kanboard instance with any valid low-privilege user account that has access to at least one project (e.g., Project #1).
2. Identify a target project: Determine the numeric ID of a restricted project the attacker cannot access (e.g., Project #3). This can be done by probing /?controller=BoardViewController&action=show&project_id=<N> and observing "Access Forbidden" responses.
3. Identify a source task: Note the task_id of a task within a project the attacker does have access to (e.g., task_id=2 in Project #1).
4. Send the malicious POST request: Submit a crafted form POST to the duplicateProjects endpoint, specifying the unauthorized target project in project_ids[]:

   POST /?controller=TaskCreationController&action=duplicateProjects&project_id=1 HTTP/1.1
   Cookie: KB_SID=<valid_session>
   Content-Type: application/x-www-form-urlencoded
   
   csrf_token=<valid_csrf>&task_id=2&project_ids[]=3

5. Confirm injection: The server responds with a 302 redirect to /board/1 (success). An administrator viewing Project #3 will see the injected task created by the attacker's account, confirming unauthorized data injection (GitHub Advisory).

• Network: HTTP POST requests to /?controller=TaskCreationController&action=duplicateProjects where the project_ids[] parameter contains project IDs the submitting user does not have access to; 302 redirect responses to /board/<source_project_id> following such requests.
• Logs: Web server access logs showing POST requests to the duplicateProjects endpoint from user sessions associated with low-privilege accounts, particularly where the target project_ids[] differ from the source project_id in the URL.
• Application Data: Unexpected tasks appearing in restricted projects with a creator account that is not a member of that project; task creation timestamps inconsistent with normal project activity.

Upgrade Kanboard to version 1.2.50 or later, which adds projectPermissionModel->isUserAllowed() checks in TaskCreationController, ProjectActionDuplicationController, and ProjectCreationController before processing any duplication request (GitHub Release, GitHub Commit). For organizations unable to patch immediately, implement network-level or WAF rules to restrict access to the duplicateProjects endpoint to trusted users only, and audit existing task duplication activity for unauthorized cross-project operations (GitHub Advisory).