CVE-2026-92802 Overview
CVE-2026-92802 is a missing authorization vulnerability [CWE-862] in Kan, an open-source kanban board application, affecting versions through 0.6.0. The flaw resides in the GitHub project import endpoint, where the server fails to validate the board:create permission before instantiating new boards. A guest-level authenticated user can invoke the importProjects mutation to create boards despite being blocked on direct board creation paths. This bypass grants low-privilege accounts unauthorized write capability against the application's core resource model.
Critical Impact
Authenticated guest users can create boards inside Kan workspaces without holding the board:create permission, undermining the application's role-based access control model.
Affected Products
- Kan (kanbn/kan) versions through 0.6.0
- GitHub project import router (packages/api/src/routers/import.ts)
- Deployments exposing the importProjects GraphQL/tRPC mutation to guest accounts
Discovery Timeline
- 2026-09-16 - CVE-2026-92802 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92802
Vulnerability Analysis
Kan implements role-based permissions where the board:create capability governs whether a user may instantiate new boards in a workspace. The direct board creation endpoint enforces this check, but the GitHub project import handler in packages/api/src/routers/import.ts does not. When a caller invokes importProjects, the router proceeds to create board records without verifying that the requesting principal holds board:create. As a result, a user with only guest role privileges can produce boards indirectly through the import workflow. The defect maps to CWE-862: Missing Authorization, a class of flaw where access control logic is absent on a code path that mutates protected resources.
Root Cause
The root cause is inconsistent permission enforcement across code paths that create the same resource type. The direct creation route validates board:create, while the import route relies only on authentication. Any authenticated session, including guests, satisfies the weaker check. See the version-specific source at v0.6.0 and the referenced import handler for the affected logic.
Attack Vector
An attacker authenticates to a Kan instance with any guest-level account. The attacker then issues an importProjects mutation targeting a GitHub project, supplying parameters that trigger board creation server-side. The router creates the boards without consulting the workspace permission map. No user interaction from an administrator is required. Additional context is available in the VulnCheck advisory and the upstream issue discussion.
Detection Methods for CVE-2026-92802
Indicators of Compromise
- Board creation events attributed to accounts that do not hold the board:create role in the workspace audit log.
- Elevated volume of importProjects mutations originating from guest or newly registered accounts.
- Boards appearing in workspaces without a corresponding entry in the direct-creation audit trail.
Detection Strategies
- Correlate application logs to flag any board creation where the actor's effective role lacks board:create.
- Instrument the importProjects handler to emit a structured event containing actor role, workspace ID, and resulting board IDs.
- Alert on repeated import invocations from a single principal within short time windows.
Monitoring Recommendations
- Forward Kan application logs to a centralized log analytics or SIEM platform and build a detection rule on role-to-action mismatch.
- Track counts of boards created per workspace per day and alert on statistical anomalies.
- Monitor authentication logs for guest account creation followed by immediate import activity.
How to Mitigate CVE-2026-92802
Immediate Actions Required
- Restrict guest registration and disable self-service account creation on internet-exposed Kan deployments until a patched release is applied.
- Audit existing workspaces for boards created through the import path by accounts lacking board:create, and remove unauthorized artifacts.
- Rotate any API tokens or session cookies belonging to accounts that abused the import mutation.
Patch Information
At the time of NVD publication (2026-09-16), Kan versions through 0.6.0 are affected. Monitor the Kan GitHub repository and the tracking issue for a fixed release, then upgrade to a version later than 0.6.0 that adds the board:create check to the import router.
Workarounds
- Place Kan behind a reverse proxy or WAF rule that blocks the importProjects mutation for unauthenticated and guest-role sessions.
- Set workspace membership defaults so new users receive no roles until an administrator promotes them.
- Apply a local patch that inserts a board:create permission check at the top of the import handler in packages/api/src/routers/import.ts before merging upstream fixes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.