CVE-2026-24885: Kanboard CSRF Vulnerability

CVE-2026-24885 Overview

A Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within Kanboard, an open-source project management software focused on Kanban methodology. Prior to version 1.2.50, the application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although the request body is JSON, the server accepts text/plain, allowing an attacker to craft a malicious form using the text/plain attribute. This enables unauthorized modification of project user roles if an authenticated admin visits a malicious site.

Critical Impact

Attackers can escalate privileges or modify user roles within Kanboard projects by tricking authenticated administrators into visiting malicious websites, potentially compromising project access controls and sensitive data.

Affected Products

• Kanboard versions prior to 1.2.50

Discovery Timeline

• February 10, 2026 - CVE-2026-24885 published to NVD
• February 10, 2026 - Last updated in NVD database

Technical Details for CVE-2026-24885

Vulnerability Analysis

This CSRF vulnerability in Kanboard arises from insufficient Content-Type validation in the ProjectPermissionController. The changeUserRole action processes JSON request bodies but does not enforce the application/json Content-Type header. By accepting text/plain content, the application inadvertently allows attackers to bypass standard CSRF protections that rely on CORS preflight checks for JSON content types.

When an authenticated administrator with project management privileges visits a malicious website, an attacker-controlled form can submit a forged request to the vulnerable endpoint. Since HTML forms can send text/plain content without triggering CORS preflight requests, the browser will automatically include the victim's session cookies, authenticating the malicious request.

Root Cause

The root cause is twofold: missing CSRF token validation on the changeUserRole action and lack of enforcement for the application/json Content-Type. The getJson() method in app/Core/Http/Request.php did not verify the Content-Type header before parsing JSON, allowing requests with text/plain to be processed as valid JSON input.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must:

1. Create a malicious webpage containing a hidden form or JavaScript
2. Craft a form submission to the /project/*/changeUserRole endpoint with a text/plain Content-Type
3. Include a JSON payload in the form body to modify user roles
4. Lure an authenticated Kanboard administrator to visit the malicious page

The form submission will bypass CORS preflight checks since text/plain is considered a "simple" content type, and the server will process the JSON body without proper validation.

// Security patch in app/Controller/ProjectPermissionController.php
// Source: https://github.com/kanboard/kanboard/commit/2c56d92783d4a3094812c2f7cba50f80a372f95e

      */
     public function changeUserRole()
     {
+        $this->checkReusableGETCSRFParam();
         $project = $this->getProject();
+
+        if (! $this->request->isAjax()) {
+            $this->response->json(array('status' => 'error'), 400);
+            return;
+        }
+
         $values = $this->request->getJson();
 
         if (empty($project) ||

The patch adds CSRF token validation via checkReusableGETCSRFParam() and enforces that requests must be AJAX requests, preventing form-based CSRF attacks.

// Security patch in app/Core/Http/Request.php
// Source: https://github.com/kanboard/kanboard/commit/2c56d92783d4a3094812c2f7cba50f80a372f95e

      * Get the Json request body
      *
      * @access public
+     * @param  bool  $enforceContentType
      * @return array
      */
-    public function getJson()
+    public function getJson($enforceContentType = true)
     {
+        if ($enforceContentType && ! $this->isJsonContentType()) {
+            return array();
+        }
+
         return json_decode($this->getBody(), true) ?: array();
     }

This additional patch enforces Content-Type validation by default when parsing JSON requests, returning an empty array if the proper application/json Content-Type is not present.

Detection Methods for CVE-2026-24885

Indicators of Compromise

• Unexpected changes to project user roles, especially privilege escalations
• Web server logs showing changeUserRole requests with text/plain Content-Type headers
• Requests to /project/*/changeUserRole endpoints originating from external referrers
• Multiple role modification requests in short succession from administrator accounts

Detection Strategies

• Monitor HTTP access logs for requests to ProjectPermissionController endpoints with non-JSON Content-Type headers
• Implement alerting for project permission changes that occur shortly after administrators access external URLs
• Review audit logs for unauthorized role modifications, particularly changes granting elevated privileges
• Configure web application firewalls to flag CSRF-like patterns targeting Kanboard endpoints

Monitoring Recommendations

• Enable detailed request logging including Content-Type headers for Kanboard application
• Implement user behavior analytics to detect anomalous administrative actions
• Monitor for referrer headers from external domains on sensitive administrative endpoints
• Set up alerts for bulk or rapid permission changes across projects

How to Mitigate CVE-2026-24885

Immediate Actions Required

• Upgrade Kanboard to version 1.2.50 or later immediately
• Review project permission audit logs for any unauthorized role changes
• Educate administrators about phishing and malicious website risks
• Consider implementing additional network-level controls to restrict access to Kanboard administrative functions

Patch Information

The vulnerability is fixed in Kanboard version 1.2.50. The security patch adds CSRF token validation and enforces proper Content-Type checking for JSON endpoints. The fix is available in commit 2c56d92783d4a3094812c2f7cba50f80a372f95e. Organizations should update through their standard package management process or download the patched release from the GitHub Release v1.2.50.

For more information, see the GitHub Security Advisory GHSA-582j-h4w4-hwr5.

Workarounds

• Implement strict Content-Security-Policy headers to prevent unauthorized form submissions
• Configure reverse proxy or WAF rules to reject requests to changeUserRole endpoints with non-JSON Content-Type
• Restrict administrative access to Kanboard through VPN or IP allowlisting
• Advise administrators to use dedicated browsers or browser profiles for Kanboard administration

# Nginx configuration to enforce Content-Type for Kanboard API endpoints
location ~ ^/\?controller=ProjectPermissionController {
    if ($content_type !~* "application/json") {
        return 415;
    }
    # Standard proxy configuration
    proxy_pass http://kanboard_backend;
}