Kanboard project management software versions 1.2.48 and earlier are impacted by an authentication bypass that occurs when REVERSE_PROXY_AUTH is enabled. The application blindly accepts HTTP headers for authentication without verifying the request originates from a trusted reverse proxy. An attacker who can send HTTP requests to the server is able to spoof the authentication header and impersonate any user, including administrators, thereby gaining unauthorized access to the system.

The vulnerability affects Kanboard software by the vendor kanboard. All installations using versions 1.2.48 or lower are vulnerable; the issue has been fixed starting with version 1.2.49.

The flaw carries a CVSS score of 9.1, indicating critical severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a malicious HTTP request with forged authentication headers to a Kanboard instance that has REVERSE_PROXY_AUTH enabled and that accepts the headers as valid. The likely attack vector is an externally reachable server where the attacker can control request headers; no additional local privilege is required. The impact is direct impersonation of any user and elevation of privileges to administrator level.