Kanboard versions 1.2.48 and earlier allow an attacker to craft protocol‑relative URLs such as //evil.com that bypass the built‑in URL validation and result in an Open Redirect. The redirect is performed for authenticated users and can be leveraged to load phishing pages, steal credentials, or serve malicious payloads. The weakness is a classic URL validation flaw (CWE-601).

The affected product is Kanboard. All releases up to and including 1.2.48 are vulnerable. The issue is resolved by installing version 1.2.49 or later.

With a CVSS score of 4.7 the threat is moderate; the EPSS score is below 1 % indicating limited exploitation probability at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must send a crafted link to an authenticated user, but no special eligibility beyond possession of a valid account is required. Failure to remediate may allow phishing campaigns to target users within the application.