CVE-2026-92802 in kan
Summary
by MITRE • 09/16/2026
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified involves a critical authorization bypass within the GitHub platform's project management subsystem, specifically affecting versions up through 0.6.0 of the relevant component or API interface. The core technical flaw resides in the validation logic governing board creation permissions during the import process. Under normal operational parameters, users are required to possess specific privileges, such as board:create, to instantiate new boards within a repository project. However, the implementation fails to enforce these access control checks when requests originate from the GitHub project import endpoint. This discrepancy creates an authorization gap where the system processes creation commands without verifying if the initiating user has the requisite permissions for that action.
This flaw is particularly exploitable because it allows attackers who hold only guest-level privileges within a repository to bypass standard security controls. Guests typically have restricted access and are explicitly denied write operations on many project features, including board management. By leveraging the importProjects mutation, an attacker can trigger the creation of new boards without triggering the permission checks that block direct creation attempts via other interfaces. This selective enforcement indicates a failure in centralized authorization logic, where different code paths for similar actions do not share consistent security policies. The attack vector relies on the structural difference between direct API calls and import-based mutations, exploiting the assumption that imported data is inherently trusted or processed with lower scrutiny than user-initiated commands.
The operational impact of this vulnerability allows unauthorized entities to manipulate project structures within targeted repositories. Attackers can create boards to organize malicious content, facilitate phishing campaigns by structuring links to exploit kits, or simply disrupt team workflows by cluttering the project interface. In a collaborative development environment, such unauthorized modifications can lead to confusion regarding task ownership and progress tracking. Furthermore, if these newly created boards are linked to issues or pull requests that contain sensitive information, it could indirectly expose confidential data to users who should not have access based on their role. The ability to create resources without proper authentication undermines the integrity of the project management system and erodes trust in the platform's security model for lower-privilege accounts.
From a classification perspective, this issue aligns with CWE-269, which denotes Improper Privilege Control, as it involves an actor obtaining privileges that they are not authorized to have. It also relates to CWE-862, Missing Authorization, because the system fails to enforce access control rules for specific actions. In terms of offensive security frameworks like MITRE ATT&CK, this behavior is consistent with techniques used in lateral movement or privilege escalation within application environments, where an attacker exploits misconfigurations to gain footholds that facilitate further exploitation. The use of mutations suggests a GraphQL-based interface, highlighting the importance of validating permissions at every entry point rather than relying on client-side restrictions or isolated server-side checks.
Mitigation strategies must focus on ensuring consistent authorization enforcement across all API endpoints and mutation types. Developers should audit the importProjects logic to verify that it invokes the same permission validation routines as direct board creation methods. Implementing a centralized access control middleware for GraphQL mutations can help standardize these checks, reducing the risk of divergent security policies. Additionally, conducting thorough penetration testing that specifically targets edge cases in bulk operations and imports is essential to uncover similar discrepancies. For users affected by this vulnerability, it is advisable to monitor project activity logs for unauthorized board creations and restrict import permissions where possible until a patched version is deployed. Regular updates to the platform components are critical to addressing these types of logic flaws before they can be systematically exploited in production environments.