CVE-2026-24885: CSRF in Kanboard Project Management Software

The primary impact of CVE-2026-24885 is the potential for unauthorized modification of project user roles within Kanboard. An attacker could craft a malicious form, leveraging the application's failure to strictly enforce the application/json Content-Type for the changeUserRole action. By tricking an authenticated administrator into visiting this form, the attacker can execute arbitrary actions as that administrator, potentially granting themselves elevated privileges or manipulating project assignments. This could lead to data breaches, project disruption, or unauthorized access to sensitive information managed within Kanboard.

1. Reserved2026-01-27
2. Published2026-02-10
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24885 is to upgrade Kanboard to version 1.2.50 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which Kanboard can load resources. Additionally, carefully review and validate all user input to prevent malicious requests. While a WAF might offer some protection, it is not a substitute for patching the vulnerability.