CVE-2026-21881: Kanboard

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.

Affected products

• Kanboard Kanboard: before 1.2.49 (fixed in 1.2.49)

Published 2026-01-08. Last modified 2026-06-17.