CVE-2026-21879

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21879", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T17:24:36.928Z", "datePublished": "2026-01-08T00:51:50.954Z", "dateUpdated": "2026-01-08T18:34:42.665Z"}, "containers": {"cna": {"title": "Kanboard vulnerable to Open Redirect via protocol-relative URLs", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq"}, {"name": "https://github.com/kanboard/kanboard/commit/93bcae03301a6d34185a8dba977417e6b3de519f", "tags": ["x_refsource_MISC"], "url": "https://github.com/kanboard/kanboard/commit/93bcae03301a6d34185a8dba977417e6b3de519f"}, {"name": "https://github.com/kanboard/kanboard/releases/tag/v1.2.49", "tags": ["x_refsource_MISC"], "url": "https://github.com/kanboard/kanboard/releases/tag/v1.2.49"}], "affected": [{"vendor": "kanboard", "product": "kanboard", "versions": [{"version": "< 1.2.49", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T00:51:50.954Z"}, "descriptions": [{"lang": "en", "value": "Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filter_var($url, FILTER_VALIDATE_URL) validation check. This vulnerability could be exploited to conduct phishing attacks, steal user credentials, or distribute malware. The issue is fixed in version 1.2.49."}], "source": {"advisory": "GHSA-mhv9-7m9w-7hcq", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T18:34:32.575700Z", "id": "CVE-2026-21879", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T18:34:42.665Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21879", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T18:34:32.575700Z"}}}], "references": [{"url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T18:34:24.332Z"}}], "cna": {"title": "Kanboard vulnerable to Open Redirect via protocol-relative URLs", "source": {"advisory": "GHSA-mhv9-7m9w-7hcq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "kanboard", "product": "kanboard", "versions": [{"status": "affected", "version": "< 1.2.49"}]}], "references": [{"url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq", "name": "https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kanboard/kanboard/commit/93bcae03301a6d34185a8dba977417e6b3de519f", "name": "https://github.com/kanboard/kanboard/commit/93bcae03301a6d34185a8dba977417e6b3de519f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kanboard/kanboard/releases/tag/v1.2.49", "name": "https://github.com/kanboard/kanboard/releases/tag/v1.2.49", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filter_var($url, FILTER_VALIDATE_URL) validation check. This vulnerability could be exploited to conduct phishing attacks, steal user credentials, or distribute malware. The issue is fixed in version 1.2.49."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T00:51:50.954Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21879", "state": "PUBLISHED", "dateUpdated": "2026-01-08T18:34:42.665Z", "dateReserved": "2026-01-05T17:24:36.928Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-08T00:51:50.954Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kanboard", "vendor": "kanboard", "versions": [{"status": "affected", "version": "< 1.2.49"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFA1D972-E76A-4A20-95F5-68D9915D3797", "versionEndExcluding": "1.2.49", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filter_var($url, FILTER_VALIDATE_URL) validation check. This vulnerability could be exploited to conduct phishing attacks, steal user credentials, or distribute malware. The issue is fixed in version 1.2.49."}, {"lang": "es", "value": "Kanboard es un software de gesti\u00f3n de proyectos centrado en la metodolog\u00eda Kanban. Las versiones 1.2.48 e inferiores son vulnerables a un ataque de redirecci\u00f3n abierta que permite a actores maliciosos redirigir a usuarios autenticados a sitios web controlados por el atacante. Al elaborar URLs como //evil.com, los atacantes pueden eludir la comprobaci\u00f3n de validaci\u00f3n filter_var($url, FILTER_VALIDATE_URL). Esta vulnerabilidad podr\u00eda ser explotada para llevar a cabo ataques de phishing, robar credenciales de usuario o distribuir malware. El problema est\u00e1 solucionado en la versi\u00f3n 1.2.49."}], "id": "CVE-2026-21879", "lastModified": "2026-06-17T10:19:04.737", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21879", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T18:34:32.575700Z", "version": "2.0.3"}}]}, "published": "2026-01-08T02:15:53.490", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/kanboard/kanboard/commit/93bcae03301a6d34185a8dba977417e6b3de519f"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/kanboard/kanboard/releases/tag/v1.2.49"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-mhv9-7m9w-7hcq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:46:24.836431+00:00", "value": {"mitigation_remediation": ["Apply the vendor-provided upgrade to Kanboard\u00a01.2.49 or later where the redirect flaw is fixed.", "Implement a temporary fix that rejects or rewrites protocol\u2011relative URLs on the server side, ensuring that all redirects contain a full scheme such as https://.", "Enable monitoring of redirect URLs and educate users about the risks of following untrusted links; consider disabling optional redirect features if the application permits."], "summary": {"action": "Patch", "impact": "Open Redirect enabling phishing, credential theft, and malware distribution"}, "threat_synthesis": {"affected_systems": "The affected product is Kanboard. All releases up to and including 1.2.48 are vulnerable. The issue is resolved by installing version 1.2.49 or later.", "description_and_impact": "Kanboard versions 1.2.48 and earlier allow an attacker to craft protocol\u2011relative URLs such as //evil.com that bypass the built\u2011in URL validation and result in an Open Redirect. The redirect is performed for authenticated users and can be leveraged to load phishing pages, steal credentials, or serve malicious payloads. The weakness is a classic URL validation flaw (CWE-601).", "risk_and_exploitability": "With a CVSS score of 4.7 the threat is moderate; the EPSS score is below 1\u202f% indicating limited exploitation probability at present, and the vulnerability is not listed in CISA\u2019s KEV catalog. Attackers must send a crafted link to an authenticated user, but no special eligibility beyond possession of a valid account is required. Failure to remediate may allow phishing campaigns to target users within the application."}}}}, "created": "2026-01-08T09:47:43.969476+00:00", "updated": "2026-04-18T17:00:05.559595+00:00", "vendors": ["kanboard", "kanboard$PRODUCT$kanboard"]}