Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Kanboard allows any user to view others' uploaded files

CVE-2023-33956 · published 3 years ago
Summary

Versions of Kanboard before 1.2.30 let a user change a file identifier in the web address and see files that belong to other users. This means private documents, images, or other data stored in the system can be read by anyone with access to the application. Upgrade to version 1.2.30 or later to stop the issue; there is no other fix available.

What to do
  • Update debian kanboard to version 1.2.26+ds-4.
  • Update kanboard kanboard to version 1.2.30 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:14 debian kanboard < 1.2.26+ds-4
Fix: upgrade to 1.2.26+ds-4
– kanboard kanboard < 1.2.30
cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*
Original advisory text
Parameter based Indirect Object Referencing leading to private file exposure in Kanboard
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any other user, regardless of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is image uploaded under **/files** directory regard less of uploaded by any user. This vulnerability poses a significant impact and severity to the application's security. By manipulating the URL parameter, an attacker can access sensitive files that should only be available to authorized users. This includes confidential documents or any other type of file stored within the application. The ability to read these files can lead to various detrimental consequences, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure of trade secrets. Additionally, it could result in legal and regulatory implications, reputation damage, financial losses, and potential compromise of user trust. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published5 Jun 2023
Updated4 Nov 2026
First seen7 May 2026
Sources
DEBIAN-CVE-2023-33956 · OSV
CVE-2023-33956 · NVD
CVE-2023-33956 · OSV
GHSA-r36m-44gg-wxg2 · GHSA
Track software like this
Free during beta