CVE-2026-25530

Kanboard is missing authorization check in getSwimlane API allows cross-project data access

4.3 Medium

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.28%Up 0.3 points since Feb 11, 2026

What each source reports

CVE List Score used 4.3

Kanboard is missing authorization check in getSwimlane API allows cross-project data access

Record: CVE-2026-25530
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2026-6464 4.3

Record: EUVD-2026-6464
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

NVD 4.3

Record: CVE-2026-25530
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-639
Updated: 2026-11-02

OSV 4.3

Kanboard is missing authorization check in getSwimlane API allows cross-project data access

Record: CVE-2026-25530
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-639
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-25530 4.3

Record: DEBIAN-CVE-2026-25530
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-25530 4.3

Record: UBUNTU-CVE-2026-25530
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

Affected products

kanboard

Affected packages

Affected packages
Package	Affected	Fixed
`kanboard-cli` Ubuntu:18.04:LTS	All versions, plus listed versions 0.0.2-1	None known
`python-kanboard` Ubuntu:18.04:LTS	All versions, plus listed versions 1.0.1-1	None known
`kanboard-cli` Ubuntu:20.04:LTS	All versions, plus listed versions 0.0.2-1	None known
`python-kanboard` Ubuntu:20.04:LTS	All versions, plus listed versions 1.0.1-1	None known
`kanboard-cli` Ubuntu:22.04:LTS	All versions, plus listed versions 0.0.2-1.1	None known
`python-kanboard` Ubuntu:22.04:LTS	All versions, plus listed versions 1.0.1-1.1	None known
`kanboard-cli` Ubuntu:24.04:LTS	All versions, plus listed versions 0.0.2-3	None known
`python-kanboard` Ubuntu:24.04:LTS	All versions, plus listed versions 1.0.1-21.1.5-1	None known
`python-kanboard` Ubuntu:25.10	All versions, plus listed versions 1.1.5-1	None known
`python-kanboard` Ubuntu:26.10	All versions, plus listed versions 1.1.5-1build1	None known
`python-kanboard` Ubuntu:26.04:LTS	All versions, plus listed versions 1.1.5-11.1.5-1build1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-25530 is a medium vulnerability (CVSS 4.3) in Kanboard, published February 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.