Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the underlying backend endpoint fails to verify this security setting. An attacker can exploit this oversight to force the server to download and install a malicious plugin, leading to arbitrary code execution. This vulnerability is fixed in 1.2.50.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-11 | 1 | Disclosure1 |
| 2026-02-13 | 1 | Patch1 |
| 2026-02-14 | 1 | Patch1 |
CVE-2026-25924 Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated ad… https://www.cve.org/CVERecord?id=CVE-2026-25924
Post summary
CVE-2026-25924 is a security control bypass vulnerability in Kanboard (versions before 1.2.50) that affects authenticated users, with no PoC, exploit, patch, or active exploitation details provided.
Authenticated admin RCE (CVE-2026-25924) in `Kanboard` prior to 1.2.50. Update `Kanboard CLI` to 1.2.50+ to mitigate. Requires existing admin access. #Kanboard #RCE #InfoSec https://www.pulsepatch.io/posts/kanboard-cli-rce-vulnerability-cve-2026-25924
Post summary
CVE-2026-25924 is an authenticated admin remote code execution vulnerability in Kanboard versions prior to 1.2.50, mitigated by updating to 1.2.50 or later.
A missing access control flaw (CVE-2026-25924) in `Kanboard` allows administrative Remote Code Execution via plugin installation. Update `Kanboard` to mitigate this #RCE #vulnerability. #infosec https://www.pulsepatch.io/posts/cve-2026-25924-kanboard-administrative-rce
Post summary
Kanboard's missing access control flaw (CVE-2026-25924) permits administrative remote code execution through plugin installation, and users are advised to update the software to mitigate the vulnerability.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kanboard | kanboard | - | - | - |