CVE-2026-21881

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-21881
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/kanboard/kanboard/commit/7af6143e2ad25b5c15549cca8af4341c7ac4e2fc Patch
https://github.com/kanboard/kanboard/releases/tag/v1.2.49 Release Notes
https://github.com/kanboard/kanboard/security/advisories/GHSA-wwpf-3j4p-739w Exploit Vendor Advisory
https://github.com/kanboard/kanboard/security/advisories/GHSA-wwpf-3j4p-739w Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*
History

20 Jan 2026, 15:57

Type Values Removed Values Added
First Time Kanboard
Kanboard kanboard
CPE cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*
References () https://github.com/kanboard/kanboard/commit/7af6143e2ad25b5c15549cca8af4341c7ac4e2fc - () https://github.com/kanboard/kanboard/commit/7af6143e2ad25b5c15549cca8af4341c7ac4e2fc - Patch
References () https://github.com/kanboard/kanboard/releases/tag/v1.2.49 - () https://github.com/kanboard/kanboard/releases/tag/v1.2.49 - Release Notes
References () https://github.com/kanboard/kanboard/security/advisories/GHSA-wwpf-3j4p-739w - () https://github.com/kanboard/kanboard/security/advisories/GHSA-wwpf-3j4p-739w - Exploit, Vendor Advisory

08 Jan 2026, 18:15

Type Values Removed Values Added
References () https://github.com/kanboard/kanboard/security/advisories/GHSA-wwpf-3j4p-739w - () https://github.com/kanboard/kanboard/security/advisories/GHSA-wwpf-3j4p-739w -

08 Jan 2026, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-08 02:15

Updated : 2026-01-20 15:57

NVD link : CVE-2026-21881

Mitre link : CVE-2026-21881

CVE.ORG link : CVE-2026-21881

JSON object : View

Products Affected

kanboard

  • kanboard
CWE
CWE-287

Improper Authentication