Vulnerability · Published Mar 18, 2026 · Assigned by GitHub_M

CVE-2026-33058Kanboard has Authenticated SQL Injection in Project Permissions Handler

High 8.4

In plain English

A high-severity SQL injection in kanboard from kanboard. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.3%top 78.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	kanboard	1.2.51+ds-1	DEBIAN-CVE-2026-33058

Affected products (as reported)

Vendor	Product	Versions
kanboard	kanboard	< 1.2.51

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

References

https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhh x_refsource_CONFIRM