Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-58660

CVE-2026-58660HIGH

Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   H   H    7.2   .0050   41.8     —

AFFECTED
  Product   Versions     Fixed
  kanboard  unspecified  564cc30e1e360959572e01e158734d9475c05903

TIMELINE
  Jul 1   Reserved by VulnCheck
  Jul 15  Published (CNA: VulnCheck)
  Oct 8   EXPLOIT PUBLISHED — CVE-2026-58660 (kanboard). Public exploit reference added.

CWE-639 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

Description

Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 1, 2026	Reserved	Reserved by VulnCheck
July 15, 2026	Published	Published (CNA: VulnCheck)
October 8, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-58660 (kanboard). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
kanboard	kanboard	—	—	564cc30e1e360959572e01e158734d9475c05903

Weaknesses

CWE-639

References (4)

Authoritative record: CVE-2026-58660 at cve.org

Vendors: kanboard

Weaknesses: CWE-639

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-58660 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.