CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2026-25531

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to duplicate tasks into projects they cannot access. This vulnerability is fixed in 1.2.50.

Score
4.3 medium
Published
2026-02-13
Links
NVD · cve.org

Affected ports (4)

PortPackageVersionStatusMaintainer
www/kanboardphp82-kanboard1.2.47_1unaddressedatanubiswas484@gmail.com
www/kanboardphp83-kanboard1.2.47_1unaddressedatanubiswas484@gmail.com
www/kanboardphp84-kanboard1.2.47_1unaddressedatanubiswas484@gmail.com
www/kanboardphp85-kanboard1.2.47_1unaddressedatanubiswas484@gmail.com

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>php82-kanboard</name>
	<range><lt>1.2.50</lt></range>
      </package>
      <package>
	<name>php83-kanboard</name>
	<range><lt>1.2.50</lt></range>
      </package>
      <package>
	<name>php84-kanboard</name>
	<range><lt>1.2.50</lt></range>
      </package>
      <package>
	<name>php85-kanboard</name>
	<range><lt>1.2.50</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Kanboard is project management software focused on Kanban methodology.
	Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The
	TaskCreationController::duplicateProjects() endpoint does not validate
	user permissions for target projects, allowing authenticated users to
	duplicate tasks into projects they cannot access. This vulnerability
	is fixed in 1.2.50.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-25531</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-25531</url>
    </references>
    <dates>
      <discovery>2026-02-13</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>