CVE-2026-25924: 
NixOS vulnerability analysis and mitigation

CVE-2026-25924 is a security control bypass vulnerability in Kanboard, an open-source project management application based on the Kanban methodology, that allows an authenticated administrator to achieve full Remote Code Execution (RCE). The flaw affects all Kanboard versions up to and including 1.2.49, and was disclosed on February 11, 2026, with a fix released in version 1.2.50. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory).

The root cause is an Incorrect Authorization flaw (CWE-863) in Kanboard's PluginController.php. While the application correctly checks the PLUGIN_INSTALLER configuration constant (defaulting to false) in UI-rendering methods such as show() and directory() to hide the plugin installation interface, the backend action methods — install(), update(), confirm(), and uninstall() — fail to perform the same Installer::isConfigured() check. An attacker with administrator credentials can directly POST to the /plugin/install endpoint with a valid CSRF token and a crafted archive_url parameter pointing to a malicious plugin archive, bypassing the intended restriction entirely. Once installed, the malicious plugin is automatically loaded by Kanboard\Core\Plugin\Loader, granting arbitrary code execution on the server (GitHub Advisory, Patch Commit).

Successful exploitation grants an attacker full Remote Code Execution on the Kanboard server, running as the web server process user. This enables complete confidentiality, integrity, and availability compromise of the affected instance — including unauthorized access to all project data, credentials stored in the database, and the ability to pivot laterally within the organization's network. All Kanboard deployments running versions prior to 1.2.50 with administrator-level accounts accessible to potentially malicious insiders or compromised credentials are at risk (GitHub Advisory).

A public proof-of-concept (PoC) exploit is available on GitHub at github.com/drkim-dev/CVE-2026-25924, published on March 2, 2026. The GitHub security advisory itself also contains detailed PoC steps. Exploitation requires authenticated administrator access and a valid CSRF token, limiting opportunistic exploitation, but insider threats or credential compromise scenarios are realistic attack paths. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.044% (GitHub Advisory, PoC Repository).

1. Obtain Administrator Credentials: Acquire valid Kanboard administrator credentials through phishing, credential stuffing, or insider access.
2. Authenticate to Kanboard: Log in to the target Kanboard instance as an administrator to establish a valid session and obtain a CSRF token from any page containing a form (e.g., the plugin management page).
3. Create a Malicious Plugin: Prepare a ZIP archive containing a Kanboard-compatible plugin structure with a Plugin.php file that executes arbitrary PHP code (e.g., a reverse shell or web shell) upon loading.
4. Host the Malicious Archive: Upload the malicious plugin ZIP to an attacker-controlled web server accessible from the Kanboard server.
5. Bypass the Security Control: Directly send an HTTP POST request to the /plugin/install endpoint with the valid CSRF token and the archive_url parameter set to the URL of the malicious plugin archive, bypassing the disabled plugin installer UI restriction.
6. Trigger Code Execution: The server downloads and installs the malicious plugin; upon the next page load or plugin loader invocation, the plugin's PHP code is executed automatically by Kanboard\Core\Plugin\Loader, achieving RCE (GitHub Advisory, PoC Repository).

• Network: Outbound HTTP/HTTPS requests from the Kanboard server to unexpected external hosts (attacker-controlled plugin archive servers); unusual inbound POST requests to /plugin/install, /plugin/update, /plugin/confirm, or /plugin/uninstall endpoints when PLUGIN_INSTALLER is set to false.
• File System: Unexpected new directories or PHP files appearing under the Kanboard plugins directory (e.g., plugins/Exploit/Plugin.php or similarly named directories); web shell files in the plugin directory.
• Logs: Web server access logs showing POST requests to plugin management endpoints from administrator sessions when plugin installation should be disabled; PHP error logs showing unexpected plugin loading activity.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., bash, curl, wget, python, nc) following plugin installation activity (GitHub Advisory).

Upgrade Kanboard to version 1.2.50 or later, which enforces Installer::isConfigured() checks in all PluginController action methods (install, update, confirm, uninstall) and throws an AccessForbiddenException when the plugin installer is disabled (Kanboard v1.2.50 Release, Patch Commit). As an interim measure, restrict administrator account access to trusted personnel only, review audit logs for unauthorized plugin installations, and consider network-level controls to block outbound connections from the Kanboard server to untrusted hosts. If plugin functionality is not required, ensure PLUGIN_INSTALLER remains set to false (the default) and monitor for any plugin directory changes.

The vulnerability was published by Kanboard maintainer fguillot via a GitHub Security Advisory on February 11, 2026. A Mastodon post from @thehackerwire noted the disclosure shortly after publication. The release of a public PoC by drkim-dev on GitHub on March 2, 2026 — and the fact that the PoC author is listed among those who reacted to the v1.2.50 release — indicates active community interest in the vulnerability. Coverage appeared on security aggregators including Vulners, CVEFeed, and VulDB shortly after disclosure (GitHub Advisory, Kanboard v1.2.50 Release).