Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck

CVE-2026-56774Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in kanboard from kanboard. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.5%top 58.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session IDs and mass-invalidate persistent login sessions of any user, including administrators, forcing re-authentication and causing denial of service.

Affected products (as reported)

Vendor	Product	Versions
kanboard	kanboard	0 – through 1.2.52

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

Researcher Disclosure technical-description, exploit
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/kanboard-cross-user-deletion-of-persistent-login-sessions-via-unvalidated-session-id third-party-advisory