Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92802kan through 0.6.0 Authorization Bypass via GitHub Project Import
Medium 4.3
In plain English
A medium-severity missing authorization in kan from kanbn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- GitHub Issue #628 issue-tracking
- https://github.com/kanbn/kan product
- importProjects asserts workspace membership only technical-description
- the Trello import path asserts the board:create permission technical-description
- VulnCheck Advisory: kan through 0.6.0 Authorization Bypass via GitHub Project Import third-party-advisory