The TaskCreationController::duplicateProjects() endpoint in Kanboard allows an authenticated user to copy tasks into projects for which they do not have permission, thereby bypassing enforced access controls. This flaw enables the user to expose task details—including identifiers, content, and metadata—that should remain confined to the target project.

Kanboard, the open‑source Kanban project‑management application, is affected in every release before version 1.2.50. The finalized fix that stops this unauthorized duplication was introduced in v1.2.50; earlier releases, including those that carried the incomplete patch for a prior CVE, remain vulnerable.

With a CVSS score of 4.3 the vulnerability is considered moderate. Its EPSS score is below 1 % and it is not listed in the CISA KEV catalog, indicating a low likelihood of active exploitation. An attacker only needs to be authenticated and possesses the ability to access the source project; no elevated privileges are required. The impact is limited to the ability to read or modify tasks in otherwise protected projects, so overall risk to an organization is modest but remedial action is recommended.