QwikSec

Security Database

CVE

CWE

Training

CVE-2026-21880

Published: Jan 8, 2026

Modified: Jan 8, 2026

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerate all LDAP users, discover sensitive user attributes, and perform targeted attacks against specific accounts. This issue is fixed in version 1.2.49.

Vendor	Product	Versions
kanboard	kanboard	affected `< 1.2.49`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

https://github.com/kanboard/kanboard/security/advisories/GHSA-v66r-m28r-wmq7

x_refsource_CONFIRM

https://github.com/kanboard/kanboard/commit/dd374079f7c2d1dab74c1680960e684ff8668586

x_refsource_MISC

https://github.com/kanboard/kanboard/releases/tag/v1.2.49

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.