Search
Find a vulnerability
Search criteria
4 vulnerabilities found for kan by kanbn
CVE-2026-92802 (GCVE-0-2026-92802)
Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-17 19:24
VLAI
EPSS
VEX
Title
kan through 0.6.0 Authorization Bypass via GitHub Project Import
Summary
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/kanbn/kan/issues/628 | issue-tracking |
| https://github.com/kanbn/kan | product |
| https://github.com/kanbn/kan/blob/v0.6.0/packages… | technical-description |
| https://github.com/kanbn/kan/blob/f08920d/package… | technical-description |
| https://www.vulncheck.com/advisories/kan-through-… | third-party-advisory |
Impacted products
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:17:03.295841Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:24:28.162Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kan",
"vendor": "kanbn",
"versions": [
{
"lessThanOrEqual": "0.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kan:kan:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:52.568Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #628",
"tags": [
"issue-tracking"
],
"url": "https://github.com/kanbn/kan/issues/628"
},
{
"tags": [
"product"
],
"url": "https://github.com/kanbn/kan"
},
{
"name": "importProjects asserts workspace membership only",
"tags": [
"technical-description"
],
"url": "https://github.com/kanbn/kan/blob/v0.6.0/packages/api/src/routers/import.ts#L622-L670"
},
{
"name": "the Trello import path asserts the board:create permission",
"tags": [
"technical-description"
],
"url": "https://github.com/kanbn/kan/blob/f08920d/packages/api/src/routers/import.ts#L259"
},
{
"name": "VulnCheck Advisory: kan through 0.6.0 Authorization Bypass via GitHub Project Import",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kan-through-0.6.0-authorization-bypass-via-github-project-import"
}
],
"title": "kan through 0.6.0 Authorization Bypass via GitHub Project Import",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92802",
"datePublished": "2026-09-16T20:32:52.568Z",
"dateReserved": "2026-09-16T19:47:13.857Z",
"dateUpdated": "2026-09-17T19:24:28.162Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32255 (GCVE-0-2026-32255)
Vulnerability from nvd – Published: 2026-03-18 23:11 – Updated: 2026-03-19 16:11Title
Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint
Summary
Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-19 16:10 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/kanbn/kan/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/kanbn/kan/commit/53397d8e81dc1… | x_refsource_MISC |
| https://github.com/kanbn/kan/releases/tag/v0.5.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-19T16:10:43.597431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-19T16:11:00.489Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kan",
"vendor": "kanbn",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-18T23:11:36.892Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg"
},
{
"name": "https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7"
},
{
"name": "https://github.com/kanbn/kan/releases/tag/v0.5.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kanbn/kan/releases/tag/v0.5.5"
}
],
"source": {
"advisory": "GHSA-qrx8-9hc6-jvqg",
"discovery": "UNKNOWN"
},
"title": "Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-32255",
"datePublished": "2026-03-18T23:11:36.892Z",
"dateReserved": "2026-03-11T15:05:48.396Z",
"dateUpdated": "2026-03-19T16:11:00.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92802 (GCVE-0-2026-92802)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-17 19:24
VLAI
EPSS
VEX
Title
kan through 0.6.0 Authorization Bypass via GitHub Project Import
Summary
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/kanbn/kan/issues/628 | issue-tracking |
| https://github.com/kanbn/kan | product |
| https://github.com/kanbn/kan/blob/v0.6.0/packages… | technical-description |
| https://github.com/kanbn/kan/blob/f08920d/package… | technical-description |
| https://www.vulncheck.com/advisories/kan-through-… | third-party-advisory |
Impacted products
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:17:03.295841Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:24:28.162Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kan",
"vendor": "kanbn",
"versions": [
{
"lessThanOrEqual": "0.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kan:kan:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:52.568Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #628",
"tags": [
"issue-tracking"
],
"url": "https://github.com/kanbn/kan/issues/628"
},
{
"tags": [
"product"
],
"url": "https://github.com/kanbn/kan"
},
{
"name": "importProjects asserts workspace membership only",
"tags": [
"technical-description"
],
"url": "https://github.com/kanbn/kan/blob/v0.6.0/packages/api/src/routers/import.ts#L622-L670"
},
{
"name": "the Trello import path asserts the board:create permission",
"tags": [
"technical-description"
],
"url": "https://github.com/kanbn/kan/blob/f08920d/packages/api/src/routers/import.ts#L259"
},
{
"name": "VulnCheck Advisory: kan through 0.6.0 Authorization Bypass via GitHub Project Import",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kan-through-0.6.0-authorization-bypass-via-github-project-import"
}
],
"title": "kan through 0.6.0 Authorization Bypass via GitHub Project Import",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92802",
"datePublished": "2026-09-16T20:32:52.568Z",
"dateReserved": "2026-09-16T19:47:13.857Z",
"dateUpdated": "2026-09-17T19:24:28.162Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32255 (GCVE-0-2026-32255)
Vulnerability from cvelistv5 – Published: 2026-03-18 23:11 – Updated: 2026-03-19 16:11Title
Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint
Summary
Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-19 16:10 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/kanbn/kan/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/kanbn/kan/commit/53397d8e81dc1… | x_refsource_MISC |
| https://github.com/kanbn/kan/releases/tag/v0.5.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-19T16:10:43.597431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-19T16:11:00.489Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "kan",
"vendor": "kanbn",
"versions": [
{
"status": "affected",
"version": "\u003c 0.5.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-18T23:11:36.892Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kanbn/kan/security/advisories/GHSA-qrx8-9hc6-jvqg"
},
{
"name": "https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kanbn/kan/commit/53397d8e81dc1494d94132848c1f0416f1152bd7"
},
{
"name": "https://github.com/kanbn/kan/releases/tag/v0.5.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kanbn/kan/releases/tag/v0.5.5"
}
],
"source": {
"advisory": "GHSA-qrx8-9hc6-jvqg",
"discovery": "UNKNOWN"
},
"title": "Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-32255",
"datePublished": "2026-03-18T23:11:36.892Z",
"dateReserved": "2026-03-11T15:05:48.396Z",
"dateUpdated": "2026-03-19T16:11:00.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}