CVE-2024-36399

Kanboard affected by Project Takeover via IDOR in ProjectPermissionController

State: Published
Severity: 8.2 High
Published: Jun 6, 2024
Updated: Aug 2, 2024
Reserved: May 27, 2024

Description

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser(). The users permission to add users to a project only get checked on the URL parameter project_id. If the user is authorized to add users to this project the request gets processed. The users permission for the POST BODY parameter project_id does not get checked again while processing. An attacker with the 'Project Manager' on a single project may take over any other project. The vulnerability is fixed in 1.2.37.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-284 Improper Access Control
CWE-285 Improper Authorization
CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
kanboardkanboard	1.2.37Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.