Vulnerability · Published Jan 8, 2026 · Assigned by GitHub_M

CVE-2026-21879Kanboard vulnerable to Open Redirect via protocol-relative URLs

Medium 4.7

In plain English

A medium-severity open redirect in kanboard from kanboard. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.3%top 75.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filter_var($url, FILTER_VALIDATE_URL) validation check. This vulnerability could be exploited to conduct phishing attacks, steal user credentials, or distribute malware. The issue is fixed in version 1.2.49.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	kanboard	1.2.49+ds-1	DEBIAN-CVE-2026-21879

Affected products (as reported)

Vendor	Product	Versions
kanboard	kanboard	< 1.2.49

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

References

https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq x_refsource_CONFIRM
https://github.com/kanboard/kanboard/commit/93bcae03301a6d34185a8dba977417e6b3de519f x_refsource_MISC
https://github.com/kanboard/kanboard/releases/tag/v1.2.49 x_refsource_MISC