https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 01:57:32 +0000 https://cve.radiocsirt.org/vuln/cve-2026-29056 <p><strong>Affected:</strong> kanboard</p> <p>Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard&#39;s user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field. An attacker who receives an invite link can inject `role=app-admin` in the registration form to create an administrator account. Version 1.2.51 fixes the issue.</p> <p><strong>Affected:</strong> kanboard</p> <p>Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard&#39;s user invite registration endpoint (`UserInviteController::register()`) accepts all POST parameters and passes them to `UserModel::create()` without filtering out the `role` field. An attacker who receives an invite link can inject `role=app-admin` in the registration form to create an administrator account. Version 1.2.51 fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-29056