CVE-2024-55603: Kanboard Session Expiry Auth Bypass Flaw

CVE-2024-55603 Overview

CVE-2024-55603 is a session management vulnerability in Kanboard, an open-source project management application built around the Kanban methodology. The flaw resides in the custom session handler (app/Core/Session/SessionHandler.php) that persists session data in a database. The read() method retrieves session rows by id without validating the expire_at column, allowing expired sessions to remain usable for authentication. Garbage collection runs probabilistically through PHP's session.gc_probability and session.gc_divisor settings, which default to 1/1000 in the official Docker image. The issue is tracked as [CWE-613: Insufficient Session Expiration] and has been fixed in Kanboard release 1.2.43.

Critical Impact
An attacker who obtains an expired session_id can continue to authenticate as the associated user because expired sessions are not evicted at read time and are only cleaned up with 0.1% probability per request.

Affected Products

Kanboard versions prior to 1.2.43
Official Kanboard Docker image using default session.gc_probability=1 and session.gc_divisor=1000
Deployments relying on the database-backed SessionHandler for session persistence

Discovery Timeline

2024-12-19 - CVE-2024-55603 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55603

Vulnerability Analysis

Kanboard implements PHP's SessionHandlerInterface to store session data in a sessions SQL table. When session_start() is invoked, PHP calls the handler's read($sessionID) method to retrieve the serialized session payload. In vulnerable versions, this method queries only on the id column and returns the stored data regardless of the row's expire_at timestamp.

PHP relies on the gc() method to purge expired rows, but PHP calls gc() probabilistically based on session.gc_probability divided by session.gc_divisor. With the Docker image's defaults, cleanup fires on roughly one request in a thousand. Between cleanups, any leaked or stolen session_id whose lifetime has already passed continues to grant authenticated access to the application.

Root Cause

The root cause is a missing expiration check in the read() method of the custom session handler. Database-backed session storage shifts expiration enforcement away from PHP's filesystem handler, and the Kanboard implementation did not reintroduce that check at the query layer. The design implicitly trusted PHP's probabilistic garbage collector to remove expired rows before they could be read.

Attack Vector

Exploitation requires an attacker to obtain a valid session_id cookie, for example through log exposure, backup theft, shared workstation reuse, or network interception. Normally the session would be unusable after expire_at, but on vulnerable Kanboard instances the attacker can replay the cookie against the application and receive authenticated responses. The request is a standard network call to the Kanboard web interface, requires no user interaction, and no additional privileges.

php

// Patched read() method in app/Core/Session/SessionHandler.php
#[\ReturnTypeWillChange]
public function read($sessionID)
{
-   $result = $this->db->table(self::TABLE)->eq('id', $sessionID)->findOneColumn('data');
+   $result = $this->db->table(self::TABLE)->eq('id', $sessionID)->gt('expire_at', time())->findOneColumn('data');
+
+   // Note: Returning false display an error message and write() is never called
+   // preventing new sessions to be created when calling session_start()
    return $result ?: '';
}

Source: Kanboard commit 7ce61c3 - the patch adds a gt('expire_at', time()) predicate so expired rows are never returned.

Detection Methods for CVE-2024-55603

Indicators of Compromise

Successful authenticated requests tied to a session_id whose corresponding expire_at value in the sessions table is in the past.
Long-lived session cookies continuing to issue requests well beyond the configured session lifetime.
Access from new IP addresses or user agents reusing session identifiers that were previously tied to a different source.

Detection Strategies

Query the Kanboard sessions table for rows where expire_at < UNIX_TIMESTAMP(NOW()) and correlate those id values against recent web access logs.
Instrument the application or reverse proxy to log the KB_SID cookie hash with each request and alert when a hash is seen after its known expiration.
Review authentication and audit logs for user activity occurring outside normal session durations defined for the deployment.

Monitoring Recommendations

Forward Kanboard web server, database, and application logs to a centralized logging or SIEM platform for retention and correlation.
Track the version string of Kanboard deployments and alert when any instance reports a version older than 1.2.43.
Schedule periodic housekeeping jobs that remove expired rows from the sessions table independent of PHP's probabilistic garbage collection.

How to Mitigate CVE-2024-55603

Immediate Actions Required

Upgrade all Kanboard instances to version 1.2.43 or later, which enforces the expiration check at query time.
Invalidate existing sessions after upgrading by truncating the sessions table so previously leaked identifiers cannot be replayed.
Rotate credentials for any accounts suspected of session exposure, particularly administrator accounts.

Patch Information

The fix is delivered in Kanboard 1.2.43 via commit 7ce61c34d962ca8b5dce776289ddf4b207be6e78. The patch modifies SessionHandler::read() to add a gt('expire_at', time()) constraint and raises garbage collection frequency in the official Docker image by setting session.gc_divisor=100 and session.gc_probability=15. See the GitHub Security Advisory GHSA-gv5c-8pxr-p484 for the full advisory.

Workarounds

The advisory states there are no known workarounds; upgrading to 1.2.43 is required.
As a compensating control until upgrade, operators can schedule an external cron job that deletes expired rows from the sessions table on a short interval.
Reducing session lifetimes narrows the exposure window but does not close the vulnerability itself.

bash

# Increase PHP session garbage collection frequency in docker/etc/php83/conf.d/local.ini
session.gc_divisor = 100
session.gc_probability = 15

Source: Kanboard commit 7ce61c3