CVE-2026-29056: 
NixOS vulnerability analysis and mitigation

CVE-2026-29056 is a privilege escalation vulnerability in Kanboard, an open-source project management application focused on Kanban methodology. The flaw exists in the user invite registration endpoint (UserInviteController::register()), which accepts all POST parameters without filtering the role field, allowing any invited user to self-assign administrator privileges via mass assignment. All Kanboard versions up to and including 1.2.50 are affected; version 1.2.51 resolves the issue. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a mass assignment vulnerability (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) in app/Controller/UserInviteController.php. The register() method calls $this->request->getValues() to collect all POST parameters and passes them directly to UserModel::create() without stripping the role field. Critically, UserValidator::validateCreation() explicitly accepts app-admin as a valid role value (validated against an allowlist of ['app-admin', 'app-manager', 'app-user']), meaning the injected role passes validation and is persisted to the database. By contrast, the UserModificationController.php profile update path correctly whitelists only permitted fields and excludes role for non-admin users — the invite registration path lacks this protection (GitHub Advisory).

An attacker who receives a valid invite link can register an account with full app-admin privileges, gaining complete administrative control over the Kanboard instance. This includes access to all projects, tasks, user data, and configuration settings. Critically, administrator access in Kanboard enables plugin installation, which has been documented as a vector for remote code execution (per GHSA-grch-p7vf-vc4f), making this vulnerability a potential privilege escalation-to-RCE chain (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a concrete curl command that any invited user can execute against a vulnerable Kanboard instance. The EPSS score is approximately 0.0015 (0.15%), indicating currently low predicted exploitation probability. The exploit requires only a valid invite token (low privilege precondition) and no user interaction beyond submitting the registration form. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Red Hat CVE).

1. Obtain an invite link: The attacker receives a legitimate invite email from a Kanboard administrator, containing a registration URL with a valid token parameter (e.g., http://TARGET/?controller=UserInviteController&action=register&token=INVITE_TOKEN).
2. Craft a malicious POST request: Instead of using the standard registration form, the attacker crafts a POST request that includes the additional role=app-admin parameter alongside the standard registration fields.
3. Submit the request: Execute the following command against the target:

curl -X POST 'http://TARGET/?controller=UserInviteController&action=register&token=INVITE_TOKEN' \
  -d 'username=attacker&password=Passw0rd123&confirmation=Passw0rd123&name=Attacker&email=attacker@example.com&role=app-admin'

4. Account created with admin role: The role=app-admin value passes the validator's allowlist check and is persisted to the database, creating the account with full administrator privileges.
5. Log in and escalate further: The attacker logs in with the newly created admin account and can install plugins, access all project data, manage users, or leverage plugin installation for remote code execution (GitHub Advisory).

• Logs: Kanboard application logs showing POST requests to /?controller=UserInviteController&action=register containing a role parameter; newly created user accounts with app-admin role that were registered via invite rather than direct admin creation.
• Database: User records in the users table with role = 'app-admin' created around the time of invite registration events, particularly accounts not created by an existing administrator through the admin panel.
• Network: HTTP POST requests to the Kanboard invite registration endpoint with form body containing role=app-admin or other elevated role values.
• Application Behavior: Unexpected new administrator accounts appearing in the Kanboard user management interface; unusual plugin installations or configuration changes made by recently registered accounts (GitHub Advisory).

Upgrade Kanboard to version 1.2.51 or later, which fixes the issue by stripping the role field from user-submitted values in the invite registration handler (unset($values['role']) before passing to the validator). As an interim workaround, restrict the distribution of invite links exclusively to fully trusted parties and audit existing user accounts for any unauthorized administrator accounts that may have been created via this vector. Organizations should also review Kanboard audit logs for suspicious registrations with elevated roles (GitHub Advisory).

The vulnerability was published by Kanboard maintainer fguillot on March 16, 2026, via GitHub Security Advisory. Social media activity includes posts on Mastodon via TheHackerWire and redistribution by RedPacketSecurity on Twitter/X. Tenable released a Nessus detection plugin (ID 302888) for the vulnerability. No major vendor statements or significant researcher commentary beyond the advisory itself have been identified (GitHub Advisory, Tenable Nessus).