Kanboard, a project management application, has a vulnerability in its Project Permissions Handler that allows an authenticated user with the right to add members to a project to inject SQL statements. This flaw is an instance of improper input handling (CWE-89) and, if exploited, can give the attacker full visibility into the database contents, effectively compromising the confidentiality of all data stored by Kanboard. The official description states that an attacker "can leverage this vulnerability to dump the entirety of the kanboard database."

The affected product is Kanboard (cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*). Versions prior to 1.2.51 are vulnerable; version 1.2.51 and later contain the fix. No other vendors or versions were listed in the CNA data.

The CVSS score of 8.4 classifies this issue as High severity, reflecting the significant impact of a data dump. The EPSS score of <1% indicates that, while the flaw exists, its exploitation probability is relatively low. The vulnerability is not listed in the CISA KEV catalog. Attackers require legitimate access with permission to add users to a project; thus exploitation is facilitated by authenticated access rather than an unauthenticated remote vector. The description does not provide additional exploitation conditions beyond the mentioned permission level.