Kanboard's user invite registration endpoint (UserInviteController::register()) processes all POST parameters and forwards them to UserModel::create() without filtering the role attribute. As a result, an attacker who obtains an invite link can submit a form with role=app-admin and create an account with full administrator privileges. This privilege escalation allows the attacker to configure boards, create projects, and alter system settings, effectively compromising the entire platform. The weakness is a Mass Assignment flaw (CWE-915).

Versions of Kanboard before 1.2.51 are affected. The official fix resides in release 1.2.51; any deployment of 1.2.50 or earlier that exposes the invite registration endpoint is vulnerable. The affected product is the Kanboard project management software provided by the vendor kanboard.

With a CVSS score of 7, the vulnerability is considered moderate to high severity. The EPSS score is <1%, indicating that it is unlikely to be widely exploited at present, and it is not cataloged in the CISA KEV list. The exploit requires an attacker to obtain or guess a valid invite link and then submit a crafted registration request, suggesting a user‑initiated web form attack. No network‑level access is required beyond the ability to reach the public invite URL.