CVE-2026-24885

CVE-2026-24885 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Kanboard project management software prior to version 1.2.50. This flaw allows an attacker to modify project user roles if an authenticated administrator visits a malicious website, due to the application's failure to strictly enforce the application/json Content-Type for the changeUserRole action. Rated with a CVSS score of 8.0 (HIGH), this vulnerability has a network attack vector, low attack complexity, and requires user interaction, but can lead to high impacts on confidentiality, integrity, and availability. The FAUCET Risk Score is 40/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public attention.