CVE-2026-29056: Kanboard Auth Bypass Vulnerability

CVE-2026-29056 Overview

CVE-2026-29056 is a privilege escalation vulnerability in Kanboard, a project management software focused on Kanban methodology. The vulnerability exists in the user invite registration endpoint (UserInviteController::register()) which accepts all POST parameters and passes them to UserModel::create() without properly filtering the role field. This allows an attacker who receives an invite link to inject role=app-admin in the registration form to create an administrator account, effectively bypassing intended access controls.

Critical Impact

An attacker with a valid invite link can escalate their privileges to full administrator access by manipulating the role parameter during registration, potentially gaining complete control over the Kanboard instance.

Affected Products

• Kanboard versions prior to 1.2.51
• All Kanboard installations using the user invite registration functionality

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-29056 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-29056

Vulnerability Analysis

This vulnerability is classified under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), also known as mass assignment. The core issue stems from the UserInviteController::register() endpoint accepting and processing all POST parameters without implementing proper allowlisting or denylisting of sensitive fields.

When a user receives an invitation link to join a Kanboard instance, they are directed to a registration form. The backend controller takes all form data and passes it directly to the UserModel::create() function. Because the role field is not filtered out from user-controlled input, an attacker can craft a malicious registration request that includes role=app-admin, effectively bypassing the intended privilege assignment mechanism.

This attack requires only that the attacker possess a valid invite link, which may be obtained through social engineering, email interception, or legitimate invitation. Once the administrator account is created, the attacker gains full control over the Kanboard instance, including access to all projects, user management capabilities, and system configuration.

Root Cause

The root cause of this vulnerability is improper input validation and a failure to implement mass assignment protection in the user registration flow. The UserInviteController::register() method does not filter or sanitize incoming POST parameters before passing them to the model layer. Specifically, the role field—which should be set programmatically based on business logic—is instead controllable by the end user through parameter injection.

Attack Vector

The attack is network-based and requires low privilege access in the form of a valid invite link. The exploitation flow involves the following steps:

1. Attacker obtains or receives a valid Kanboard user invitation link
2. When submitting the registration form, the attacker intercepts the request and adds the role=app-admin parameter
3. The backend processes all parameters including the injected role value
4. A new user account is created with administrator privileges
5. The attacker now has full administrative access to the Kanboard instance

The vulnerability mechanism involves parameter injection during the user registration process. When the UserInviteController::register() method receives the POST request, it passes all parameters directly to UserModel::create() without filtering sensitive fields like role. An attacker can exploit this by adding role=app-admin to their registration request payload, which the system processes and applies, resulting in the creation of an administrator account. For complete technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-29056

Indicators of Compromise

• Newly registered user accounts with administrator privileges that were created through invite links
• Unusual POST request parameters containing role=app-admin in registration endpoint logs
• Multiple failed or successful registration attempts with additional unexpected parameters
• Administrator accounts created without corresponding administrative invitation workflows

Detection Strategies

• Monitor web server access logs for POST requests to the user invite registration endpoint containing the role parameter
• Implement application-level logging to track user creation events and flag any non-standard privilege assignments
• Review database audit logs for user accounts created with elevated privileges through the invitation workflow
• Deploy web application firewall (WAF) rules to detect and block requests containing unauthorized parameter injection attempts

Monitoring Recommendations

• Enable detailed logging for all user registration and authentication events in Kanboard
• Set up alerts for new administrator account creation, especially those originating from invite registrations
• Regularly audit user accounts and their privilege levels to identify any unauthorized escalations
• Monitor for unusual patterns in user registration behavior, including parameter manipulation attempts

How to Mitigate CVE-2026-29056

Immediate Actions Required

• Upgrade Kanboard to version 1.2.51 or later immediately
• Audit all existing user accounts created through the invite registration process for unauthorized administrator privileges
• Revoke administrator access from any accounts that were improperly elevated
• Temporarily disable the user invite functionality if immediate patching is not possible

Patch Information

Kanboard version 1.2.51 addresses this vulnerability by implementing proper input filtering in the UserInviteController::register() method to prevent the role field from being controlled by user input. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed patch information, see the Kanboard Security Advisory on GitHub.

Workarounds

• Disable the user invite registration functionality until the patch can be applied
• Implement a web application firewall (WAF) rule to strip or block the role parameter from registration requests
• Manually review and approve all new user registrations before granting system access
• Limit distribution of invite links to trusted internal processes only

If immediate patching is not feasible, consider implementing network-level controls or reverse proxy rules to filter malicious parameters. The following example demonstrates a basic approach using nginx to strip the role parameter from registration requests:

# Nginx configuration to mitigate parameter injection
# Add to server block configuration
location /user/invite/register {
    # Log suspicious requests containing role parameter
    if ($args ~* "role=") {
        access_log /var/log/nginx/kanboard_suspicious.log;
    }
    
    # Consider blocking requests with role parameter entirely
    # if ($request_body ~* "role=") {
    #     return 403;
    # }
    
    proxy_pass http://kanboard_backend;
}