Kanboard afectado por Cross-Site Request Forgery (CSRF) a través de una configuración incorrecta del Content-Type en la asignación de roles de proyecto

The primary impact of CVE-2026-24885 is the potential for unauthorized modification of project user roles within Kanboard. An attacker could craft a malicious form, leveraging the application's failure to strictly enforce the application/json Content-Type for the changeUserRole action. By tricking an authenticated administrator into visiting this form, the attacker can execute arbitrary actions as that administrator, potentially granting themselves elevated privileges or manipulating project assignments. This could lead to data breaches, project disruption, or unauthorized access to sensitive information managed within Kanboard.

Organizations utilizing Kanboard for project management, particularly those with administrative users who frequently interact with external websites or applications, are at risk. Shared hosting environments where multiple Kanboard instances reside on the same server could also be vulnerable if one instance is compromised.

• php: Examine Kanboard application logs for suspicious requests with Content-Type: text/plain targeting the changeUserRole endpoint. Use PHP's built-in logging to monitor for unusual activity.

// Example: Monitor for text/plain Content-Type
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_SERVER['CONTENT_TYPE']) && $_SERVER['CONTENT_TYPE'] === 'text/plain') {
  error_log('Suspicious request: text/plain Content-Type detected for changeUserRole');
}

1. 2026-02-10Disclosure

   disclosure

1. Reservado2026-01-27
2. Publicada2026-02-10
3. EPSS actualizado2026-03-23

The primary mitigation for CVE-2026-24885 is to upgrade Kanboard to version 1.2.50 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing a Content Security Policy (CSP) to restrict the sources from which Kanboard can load resources. Additionally, carefully review and validate all user input to prevent malicious requests. While a WAF might offer some protection, it is not a substitute for patching the vulnerability.