Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-110628

Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Kan
Products
Kan
CVE-2026-92802

kan through 0.6.0 Authorization Bypass via GitHub Project Import

kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kan Kanbn
Products
Kan Kan
CVE-2026-32255

Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint

Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation. The Attachment Download endpoint accepts a user-supplied URL query parameter and passes it directly to fetch() server-side, and returns the full response body. An unauthenticated attacker can use this to make HTTP requests from the server to internal services, cloud metadata endpoints, or private network resources. This issue has been fixed in version 0.5.5. To workaround this issue, block or restrict access to /api/download/attatchment at the reverse proxy level (nginx, Cloudflare, etc.).

CVSS 3.1 · 8.6 High EPSS 28.5% KEV · Not listed
Vendors
Kan Kanbn
Products
Kan Kan