← Back to CVE List
CVE-2026-92802NVD
Vulnerability Summary
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
CVSS v4.0 Base Metrics — Score 5.3 (MEDIUM)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredLow
User InteractionNone
Confidentiality (Vulnerable System)None
Integrity (Vulnerable System)Low
Availability (Vulnerable System)None
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 4.3 (MEDIUM)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityLow
AvailabilityNone
Affected & Patched Versions
- kanbn kan <= 0.6.0
- kanbn kan 0.6.0
External References
- https://github.com/kanbn/kan/issues/628
- https://github.com/kanbn/kan
- https://github.com/kanbn/kan/blob/v0.6.0/packages/api/src/routers/import.ts#L622-L670
- https://github.com/kanbn/kan/blob/f08920d/packages/api/src/routers/import.ts#L259
- https://www.vulncheck.com/advisories/kan-through-0.6.0-authorization-bypass-via-github-project-import