CVE-2026-56774

Medium

Description

Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session IDs and mass-invalidate persistent login sessions of any user, including administrators, forcing re-authentication and causing denial of service.

SeverityMedium

CVSS5.4

Exploit probability—

ProductKanboard

PublishedJun 25, 2026

First seenJun 25, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Patches

github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1

Affected products

Product	Affected versions	Fixed in
kanboard kanboard	v ≤ 1.2.52	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.