Kanboard implements a project authorization module that allows administrators to assign roles to users. Before version 1.2.50, the controller that handles role changes does not enforce the Content-Type header for the request body, accepting text/plain even though the body is JSON. An attacker can send a forged request from a malicious webpage that sets the Content-Type to text/plain and post JSON data, exploiting CSRF. The result is that an authenticated administrator who inadvertently visits a malicious site can have the role of a user changed without knowing it, effectively elevating or delegating privileges.

All installations of Kanboard earlier than 1.2.50 are affected. The product is distributed under the project name Kanboard, version 1.0 through 1.2.49. The applicable vendor/product is kanboard:kanboard, as reflected in the CNA listing. No additional versions or distributions are mentioned.

The CVSS base score of 5.7 indicates moderate severity with an attacker authenticating as an administrator to perform the action. EPSS is reported as < 1%, suggesting the likelihood of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires an authenticated admin, a web page capable of sending a POST request to the changeUserRole endpoint, and the ability to coerce the admin to visit that page. Once a request is sent, the server process accepts it because it does not check the Content-Type, allowing the role change API to be invoked with attacker-supplied JSON.