Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-36399: Kanboard allows project takeover by manager

CVE-2024-36399 · published 2 years ago

Summary

Kanboard's project management tool lets a user with manager rights for one project add themselves to any other project because the software only checks permissions in the URL, not in the form data. This means a manager could gain control of unrelated projects. Upgrade to version 1.2.37 or later to stop the issue.

What to do

Update debian kanboard to version 1.2.44+ds-1.
Update kanboard kanboard to version 1.2.37 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:14	debian	kanboard	< 1.2.44+ds-1 Fix: upgrade to 1.2.44+ds-1
–	kanboard	kanboard	< 1.2.37 `cpe:2.3:a:kanboard:kanboard::::::::`

Original advisory text

Kanboard affected by Project Takeover via IDOR in ProjectPermissionController

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.

References

https://security-tracker.debian.org/tracker/CVE-2024-36399 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36399... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-36399 Vendor Advisory
https://github.com/kanboard/kanboard/security/advisories/GHSA-x8v7-3ghx-65cv Vendor Advisory
https://github.com/kanboard/kanboard/commit/b6703688aac8187f5ea4d4d704fc7afeeffe... Patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

CWE-285Improper Authorization

CWE-639Authorization Bypass Through User-Controlled Key

Timeline

Published6 Jun 2024

Updated4 Nov 2026

First seen7 May 2026

Sources

DEBIAN-CVE-2024-36399 · OSV

CVE-2024-36399 · NVD

CVE-2024-36399 · OSV

GHSA-x8v7-3ghx-65cv · GHSA

Track software like this

Free during beta