CVE-2026-33058: 
NixOS vulnerability analysis and mitigation

CVE-2026-33058 is an authenticated SQL injection vulnerability in Kanboard, open-source project management software built around the Kanban methodology. It affects all versions up to and including 1.2.50, and was disclosed on March 17–18, 2026 via a GitHub Security Advisory. Attackers with permission to add users to a project can exploit this flaw to dump the entire Kanboard database. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.4 (High) (GitHub Advisory).

The root cause is improper neutralization of SQL identifiers (CWE-89) in the getOrCreateExternalUserId method of UserModel.php. The addUser action in ProjectPermissionController.php accepts a user-controlled external_id_column POST parameter, which is passed directly as the column name to the PicoDb ORM's eq() operator. The escapeIdentifier() function in ConditionBuilder.php is intended to sanitize column names, but it returns early without sanitization if the value contains a dot (.) or a space ( ), allowing an attacker to inject arbitrary SQL. This results in a blind SQL injection exploitable via the /project/N/permissions endpoint using tools like SQLMap or a custom Python script (GitHub Advisory).

Successful exploitation allows an authenticated attacker with project user-add permissions to exfiltrate the entire Kanboard database, including user credentials, API access tokens, and all project data. A demonstrated second-stage attack shows that the extracted admin API key can be used to invoke the JSONRPC endpoint (/jsonrpc.php) to escalate the attacker's account role to app-admin, achieving full application-level privilege escalation. Confidentiality is severely impacted; integrity is also affected through the privilege escalation path, while availability is not directly impacted (GitHub Advisory).

A working proof-of-concept is publicly available in the GitHub Security Advisory, including a SQLMap command targeting the vulnerable endpoint and a Python script (poc.py) that automates blind SQL injection to extract the admin API key and escalate privileges. The EPSS score is approximately 0.03%, indicating low current automated exploitation probability. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog as of the time of this report (GitHub Advisory).

1. Authenticate: Log in to the target Kanboard instance with an account that has permission to add users to at least one project.
2. Identify target project: Navigate to /project/N/permissions (where N is the project ID) to confirm access to the user-add functionality and retrieve the CSRF token from the form.
3. Craft malicious request: Submit a POST request to /?controller=ProjectPermissionController&action=addUser&project_id=N with the external_id_column parameter set to a SQL injection payload. Because escapeIdentifier() skips sanitization when the value contains a space or dot, a payload like (CASE WHEN 1=1 THEN 'dummy' ELSE NULL END) is passed directly into the SQL query.
4. Automate with SQLMap: Run SQLMap against the endpoint to enumerate and dump the database:

   sqlmap --url 'http://target/?controller=ProjectPermissionController&action=addUser&project_id=1' \
     -H 'Cookie: KB_SID=...; KB_RM=...' \
     --data 'csrf_token=TOKEN&user_id=&username=admin&external_id=dummy&external_id_column=dummy&name=admin&role=project-member' \
     -p 'external_id_column' --dbms sqlite --tables --flush-session

5. Extract admin API key: Use the Python poc.py script with blind boolean-based injection to character-by-character extract the api_access_token of the admin user from the users table.
6. Escalate privileges: Use the extracted API key to authenticate to the JSONRPC endpoint and update the attacker's account role to app-admin:

   POST /jsonrpc.php (Basic Auth: admin:<api_key>)
   {"jsonrpc":"2.0","method":"updateUser","params":{"id":<attacker_user_id>,"role":"app-admin"}}

   (GitHub Advisory)

• Network: Repeated POST requests to /?controller=ProjectPermissionController&action=addUser&project_id=N with unusual or encoded values in the external_id_column parameter; multiple requests with slight variations in external_id_column values (indicative of blind SQL injection enumeration); POST requests to /jsonrpc.php using Basic Authentication from non-admin accounts.
• Logs: Web server access logs showing high-frequency POST requests to the addUser endpoint from a single authenticated session; HTTP 302 redirect responses from the addUser endpoint in rapid succession (boolean-based blind injection pattern); JSONRPC calls to updateUser method with role: app-admin from unexpected users.
• Application: Unexpected role changes for user accounts (e.g., non-admin users elevated to app-admin); new or modified entries in the users table with elevated privileges.
• Process: Unusual database query patterns in SQLite logs (if query logging is enabled), particularly CASE WHEN expressions or subqueries in WHERE clauses of SELECT statements on the users table. (GitHub Advisory)

Upgrade Kanboard to version 1.2.51 or later, which fixes the SQL injection by properly validating the external_id_column parameter before use in database queries. As a workaround prior to patching, restrict the "add users to project" permission to only highly trusted administrators to reduce the attack surface. Additionally, monitor database activity and web server logs for anomalous POST requests to the addUser endpoint with unusual external_id_column values (GitHub Advisory).

The vulnerability was discussed on Reddit's r/netsec community and on Mastodon (infosec.exchange), with posts referencing the CVE and the technical write-up. A detailed researcher blog post was published at 0dave.ch covering the exploitation mechanics. The vulnerability was also covered by infinitsec.net and indexed by security platforms including Tenable Nessus (plugin 302889), VulDB, and CXSecurity. Community sentiment reflects moderate concern given the public PoC and privilege escalation potential, though the authenticated prerequisite limits the immediate risk (Reddit, 0dave.ch).