Kanboard up to 1.2.50 Registration register dynamically-determined object attributes

Summaryinfo

A vulnerability was found in Kanboard up to 1.2.50. It has been declared as critical. The impacted element is the function UserInviteController::register of the component Registration Handler. Executing a manipulation can lead to dynamically-determined object attributes. This vulnerability is registered as CVE-2026-29056. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Kanboard up to 1.2.50 and classified as critical. This vulnerability affects the function UserInviteController::register of the component Registration Handler. The manipulation with an unknown input leads to a dynamically-determined object attributes vulnerability. The CWE definition for the vulnerability is CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field. An attacker who receives an invite link can inject `role=app-admin` in the registration form to create an administrator account. Version 1.2.51 fixes the issue.

The advisory is available at github.com. This vulnerability was named CVE-2026-29056 since 03/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 302888 (Linux Distros Unpatched Vulnerability : CVE-2026-29056), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.2.51 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (302888). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Forum Software

Name

• Kanboard

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.2.14
• 1.2.15
• 1.2.16
• 1.2.17
• 1.2.18
• 1.2.19
• 1.2.20
• 1.2.21
• 1.2.22
• 1.2.23
• 1.2.24
• 1.2.25
• 1.2.26
• 1.2.27
• 1.2.28
• 1.2.29
• 1.2.30
• 1.2.31
• 1.2.32
• 1.2.33
• 1.2.34
• 1.2.35
• 1.2.36
• 1.2.37
• 1.2.38
• 1.2.39
• 1.2.40
• 1.2.41
• 1.2.42
• 1.2.43
• 1.2.44
• 1.2.45
• 1.2.46
• 1.2.47
• 1.2.48
• 1.2.49
• 1.2.50

License

• open-source

Website

• Product: https://github.com/kanboard/kanboard/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion