Kanboard, a Kanban‑focused project management tool, contains a security control bypass that permits an authenticated administrator to install arbitrary plugins without proper access checks. The backend endpoint responsible for plugin installation does not respect the PLUGIN_INSTALLER configuration flag, enabling the server to download and install a malicious plugin, thus providing full Remote Code Execution. The flaw is classified as a Missing Access Control (CWE‑863).

Any installation of Kanboard older than version 1.2.50 is vulnerable. The affected product is Kanboard project management software. All installations that allow an administrator to authenticate are at risk, regardless of the deployment environment. The vulnerability is mitigated by upgrading to version 1.2.50 or later.

The CVSS score of 8.5 indicates a high impact, while the EPSS probability is < 1%, suggesting the exploit is unlikely to be widely used at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate as an administrator; from that position they can exploit the unprotected plugin‑installation endpoint to execute arbitrary code on the server.