All issues

Search results

[Feature]: createTaskFile/createProjectFile cannot set the uploader: Add optional creator_id

Status: Open.

Feature

#5895 In kanboard/kanboard;

· TheRealCuran opened on Sep 4, 2026

[Bug][Security]: Project authorization is bypassed by identifiers supplied in the request body (3 exploitable instances: cross-project task exfiltration, mass task closure, subtask position write)

triage needed

Status: Open.

Bug

#5894 In kanboard/kanboard;

· AuQuangDuc opened on Sep 1, 2026

[Bug]: http page login not working

triage needed

Status: Open.

Bug

#5893 In kanboard/kanboard;

· lucasarrudadev opened on Aug 30, 2026

getProjectByName/ByIdentifier/ByEmail: distinguishable responses allow probing existence of arbitrary (private) projects

Status: Open.

#5878 In kanboard/kanboard;

· ybsun0215 opened on Aug 15, 2026

Activity and comment APIs expose other users' email addresses to project members (getMyActivityStream/getProjectActivity/getProjectActivities/getComment/getAllComments)

Status: Open.

#5876 In kanboard/kanboard;

· ybsun0215 opened on Aug 15, 2026

Revoked project members keep reading assigned tasks via getMyDashboard/getMyOverdueTasks (no membership filter in getUserQuery)

Status: Open.

#5874 In kanboard/kanboard;

· ybsun0215 opened on Aug 15, 2026

[Security] SSRF: isPrivateURL() bypassed by decimal/hex IPv4 and IPv6-literal hosts (external links & webhooks)

triage needed

Status: Open.

Bug

#5871 In kanboard/kanboard;

· Abdulhofiz opened on Jul 31, 2026

[Bug]: New LDAP-users don't get notifications even if the app settings force this

triage needed

Status: Open.

Bug

#5869 In kanboard/kanboard;

· h-e-l-l-o-w-o-r-l-d opened on Jul 29, 2026

Brute-force lockout is keyed on the leftmost X-Forwarded-For value (incomplete fix for CVE-2025-52576)

Status: Open.

#5862 In kanboard/kanboard;

· krishnextgencyber opened on Jul 26, 2026

No rate limiting on two-factor code verification allows TOTP brute-force (TwoFactorController::check)

Status: Open.

#5859 In kanboard/kanboard;

· krishnextgencyber opened on Jul 26, 2026

SSRF protection bypass: bracketed IPv6 literals defeat isPrivateURL() (loopback, RFC1918, cloud metadata)

Status: Open.

#5858 In kanboard/kanboard;

· krishnextgencyber opened on Jul 26, 2026

[Bug]: Problem with notification

triage needed

Status: Open.

Bug

#5840 In kanboard/kanboard;

· phatair opened on Jun 26, 2026