Nixpkgs security tracker
NIXPKGS-2026-0234
GitHub issue
published on
Permalink
CVE-2026-25924
8.4 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): High (H)
- User Interaction (UI): Required (R)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): High (H)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse accepted
- @LeSuisse published on GitHub
Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the underlying backend endpoint fails to verify this security setting. An attacker can exploit this oversight to force the server to download and install a malicious plugin, leading to arbitrary code execution. This vulnerability is fixed in 1.2.50.
References
-
https://github.com/kanboard/kanboard/security/advisories/GHSA-grch-p7vf-vc4f x_refsource_CONFIRM
-
https://github.com/kanboard/kanboard/releases/tag/v1.2.50 x_refsource_MISC
Affected products
kanboard
- ==< 1.2.50
Package maintainers
-
@yzx9 Zexin Yuan <yuan.zx@outlook.com>