CVE-2026-29056Disclosure(kanboard / kanboard)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch kanboard kanboard systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field. An attacker who receives an invite link can inject `role=app-admin` in the registration form to create an administrator account. Version 1.2.51 fixes the issue.

kanboard CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-915

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

kanboard

Threat summary

Patch or workaround signal is available
5 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 1d ago at 4 mentions (2026-03-18); latest day: 1
5 total mentions across 2 days

Affected systems

Vendors

kanboard

Products

kanboard

Deep dive

Activity timeline5 mentions / 2d

Signal classification2 categories

Disclosure

360.0%

General

240.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-18	4	Disclosure3General1
2026-03-19	1	General1

Full discourse5 posts

RedPacket Security@RedPacketSec205d
General
CVE Alert: CVE-2026-29056 - kanboard - kanboard - https://www.redpacketsecurity.com/cve-alert-cve-2026-29056-kanboard-kanboard/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-29056 #kanboard #
Post summary
The post merely cites a link to a CVE alert for CVE-2026-29056 without offering additional technical or exploit information.
0000074
3.6K followersView on X
The Hacker Wire@TheHackerWire206d
Disclosure
🟠 CVE-2026-29056 - High Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register()`) accepts all POST para... https://www.thehackerwire.com/vulnerability/CVE-2026-29056/ https://t.co/5cIsNdf9So
Post summary
The text announces a high‑severity vulnerability in Kanboard where the user invite registration endpoint accepts arbitrary POST parameters, fixed in version 1.2.51; no PoC or exploit is reported.
0000050
138 followersView on X
CVEarity@CVEarity206d
General
⚡ New CVE Alert: CVE-2026-29056 📊 Severity: 7.0 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-29056 #CVE-2026-29056 #CVE #High #CyberSecurity #InfoSec https://t.co/VhtnX1Wvbk
Post summary
The tweet announces CVE‑2026‑29056 with a 7.0 severity rating and high risk, but it offers no technical details, patches, or evidence of exploitation.
0000032
104 followersView on X
CVE@CVEnew206d
Disclosure
CVE-2026-29056 Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register(… https://www.cve.org/CVERecord?id=CVE-2026-29056
Post summary
The entry notes that CVE‑2026‑29056 impacts Kanboard’s user‑invite registration endpoint and is mitigated in version 1.2.51, with no evidence of active exploitation or PoC.
00000101
56.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds206d
Disclosure
CVE-2026-29056 Privilege Escalation in Kanboard User Registration via Role Parameter Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-29056
Post summary
The post announces CVE-2026-29056, highlighting a privilege‑escalation flaw in Kanboard caused by role‑parameter injection during user registration, but provides no PoC, exploit, patch information, or evidence of active exploitation.
0000034
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	kanboard	kanboard	-	-	-

Explore more

Back to dashboard kanboard CVEs kanboard vulnerabilities

What researchers are saying

CVE-2026-29056

RedPacket Security@RedPacketSecGeneral

The post merely cites a link to a CVE alert for CVE-2026-29056 without offering additional technical or exploit information.

The Hacker Wire@TheHackerWireDisclosure

The text announces a high‑severity vulnerability in Kanboard where the user invite registration endpoint accepts arbitrary POST parameters, fixed in version 1.2.51; no PoC or exploit is reported.

CVEarity@CVEarityGeneral

The tweet announces CVE‑2026‑29056 with a 7.0 severity rating and high risk, but it offers no technical details, patches, or evidence of exploitation.

CVE@CVEnewDisclosure

The entry notes that CVE‑2026‑29056 impacts Kanboard’s user‑invite registration endpoint and is mitigated in version 1.2.51, with no evidence of active exploitation or PoC.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE-2026-29056, highlighting a privilege‑escalation flaw in Kanboard caused by role‑parameter injection during user registration, but provides no PoC, exploit, patch information, or evidence of active exploitation.