CVE-2026-21879
Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites.
Does this matter?
Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.
Description
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filter_var($url, FILTER_VALIDATE_URL) validation check. This vulnerability could be exploited to conduct phishing attacks, steal user credentials, or distribute malware. The issue is fixed in version 1.2.49.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.30% probability · 23th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-601
- Affected
- kanboard/kanboard
- Source
- security-advisories@github.com
References
- https://github.com/kanboard/kanboard/commit/93bcae03301a6d34185a8dba977417e6b3de519fPatch
- https://github.com/kanboard/kanboard/releases/tag/v1.2.49Release Notes
- https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcqExploit, Third Party Advisory
- https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcqExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.