The vulnerability arises because the getSwimlane API method in Kanboard does not enforce project-level authorization checks. An authenticated user can invoke the API and retrieve swimlane data from any project, including those they should not be able to view. This results in the disclosure of confidential project information to unauthorized users. The weakness is classified as CWE-639, which describes an authorization bypass through user‑controlled input.

Kanboard project‑management software, product kanboard produced by kanboard, is affected. Any installation running a version prior to 1.2.50 is vulnerable. The patch was released in version 1.2.50.

The CVSS score for this issue is 4.3, indicating a medium impact. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. It is not present in the CISA KEV catalog. Because the flaw requires an authenticated user, an attacker would need valid credentials or exploit a legitimate login process to provoke the cross‑project data retrieval.