CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users in Kanboard versions up to 1.2.52 to manipulate tasks across different projects by exploiting insufficient validation in the BoardAjaxController's save() method. This could lead to unauthorized task enumeration and modification, potentially compromising the integrity of private projects. Organizations using Kanboard should prioritize this issue to prevent data leakage and unauthorized access to sensitive project information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.