CVE-2026-56774: Kanboard Session Deletion Authorization Bypass

Technical summary

The UserViewController::removeSession method fails to perform authorization checks on the session_id parameter before invoking RememberMeSessionModel::remove. The vulnerability exists because the handler accepts user-supplied session identifiers without validating that the requester owns the session being terminated. Since Remember Me sessions follow predictable, enumerable identifiers, an authenticated attacker can iterate through possible values and delete arbitrary sessions. The fix, implemented in commit 928c68a, introduces proper session ownership validation to ensure users can only revoke their own persistent login tokens.

Business impact

This vulnerability enables account disruption attacks that degrade user experience and administrative productivity. Attackers can selectively or mass-logout high-value users, administrators, or entire user cohorts, forcing re-authentication workflows and consuming support resources. In multi-tenant or compliance-sensitive environments, session hijacking and forced logouts may also create audit trail complications and regulatory reporting obligations. The attack requires only basic authentication access, making it a concern for any organization with hostile insiders or compromised low-privilege accounts.

Affected systems

Kanboard through version 1.2.52 is affected. The vulnerability is patched in commit 928c68a; verify the exact patched version against the official Kanboard repository or release notes. All deployment models—self-hosted, containerized, or cloud instances—running vulnerable versions are at risk if user authentication is enabled.

Exploitability

Exploitability is straightforward. The attack requires only valid user credentials (low-barrier authentication) and network access to the Kanboard instance. No user interaction, phishing, or complex multi-step compromise is needed. The sequential nature of session IDs makes enumeration practical, and bulk session deletion is achievable through simple scripting. However, the attack does not yield direct confidentiality gains; impact is operational disruption and availability degradation rather than data exfiltration.

Remediation

Update to a Kanboard version containing the fix from commit 928c68a or later. If immediate patching is delayed, implement network-level access controls to restrict RememberMeSession deletion endpoints to trusted users, or disable Remember Me functionality at the application configuration level if the feature is not essential. Monitor session deletion logs for unusual patterns indicating active exploitation.

Patch guidance

Apply the official patch from the Kanboard project repository matching or exceeding commit 928c68a. Verify the patched version in your release channel (stable, beta, etc.) and test in a staging environment before production deployment. If running a containerized version, rebuild images from the patched source or pull the updated official image tag. Document the patch version applied for compliance and audit purposes.

Detection guidance

Monitor UserViewController::removeSession API calls and RememberMeSessionModel::remove invocations for high-frequency or cross-user patterns. Alert on users deleting session IDs they do not own (correlate user context with session ownership metadata). Log all Remember Me session terminations with user ID, session ID, and timestamp. Implement baseline profiling to flag accounts that suddenly revoke many sessions in short time windows—a signature of enumeration attacks.

Why prioritize this

This vulnerability merits prompt attention despite its medium CVSS score because it directly impacts availability and user session integrity. Unlike exploits requiring exploitation chains or user tricks, this attack is trivially executable by any authenticated user and scales quickly via scripting. Organizations with high-availability requirements, administrative user bases, or sensitive operational workflows should prioritize patching. The lack of KEV designation does not diminish real-world risk; mass session revocation is an effective denial-of-service technique.

Risk score, explained

CVSS 5.4 reflects low attack complexity, no special privileges required beyond authentication, and dual impact: integrity (unauthorized session termination) and availability (forced re-authentication). The vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L indicates network accessibility, low barrier to exploitation, requirement for prior authentication, no confidentiality breach, minor integrity damage, and minor availability impact per-user. The score appropriately captures an authenticated abuse-of-function vulnerability that is painful operationally but not data-critical.

Frequently asked questions