CVE-2026-21881 — Kanboard is Vulnerable to Reverse Proxy Authentication Bypass
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is ena…
Published: 2026-01-08 · CVSS: 9.1 · CVSS 3.1
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7