Description
Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kanboard kanboard
Default version status: unaffected
0 to < 1.2.53affected1.2.53unaffected564cc30e1e360959572e01e158734d9475c05903unaffected
pkg:github/kanboard/kanboard