VulnSocial

CVE-2026-21881Disclosure(kanboard / kanboard)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch kanboard kanboard systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.

kanboard CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • kanboard

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
kanboard
Products
kanboard

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-20: 1Patch / Workaround · 2026-04-20: 1Technical Details · 2026-04-20: 104-20
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Security Arsenal, LLC@SecurityAr58409
    Disclosure

    🔒 #CyberSecurity CVE-2026-21881 & CVE-2026-21882: Critical Excel RCE and Defender LPE — Detectio… "Defend against a critical 17-year-old Excel code execution flaw and an unpatched Microsoft…" 🔗 https://securityarsenal.com/blog/cve-2026-21881-and-cve-2026-21882-critical-excel-rce-and-defender-lpe-detection-and-remediation #CyberSecurity #ThreatIntel #cve #zeroday #patchtuesday

    Post summary

    The post announces new critical CVEs for Excel (RCE) and Defender (LPE), linking to a blog that likely covers detection and remediation, but it does not provide PoC, exploit code, or evidence of active attacks.

    0000050
    11 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appkanboardkanboard---

Explore more

Back to dashboardkanboard CVEskanboard vulnerabilities