The vulnerability lies in the BoardAjaxController save() method, which during a drag-and-drop operation validates the caller’s role for the supplied project_id but neglects to confirm that the provided task_id actually resides in that project. As task identifiers are sequential integers shared across the entire Kanboard instance, an attacker can fabricate a legitimate project_id and any valid task_id to move, hide, or otherwise corrupt tasks that belong to projects in which the attacker has no membership or role. This allows a user who is part of at least one project to compromise the integrity and visibility of privately held work items in other projects. The weakness is a classic example of CWE‑639, where authorization is bypassed through a user‑controlled key.

Kanboard applications up to and including version 1.2.52 are affected. The flaw manifests in the Kanboard Kanboard product via the BoardAjaxController drag-and-drop endpoint, and the fix is applied in commit 564cc30 of the GitHub repository. All Kanboard instances running a version without this commit are vulnerable regardless of the number of projects or users present.

With a CVSS score of 7.2 the vulnerability is considered high severity. The EPSS score is less than 1 %, indicating a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An authenticated user who belongs to any project can target the system by sending a crafted request to the drag-and-drop endpoint, specifying a task_id from another project. Because no code execution or privilege escalation is required, the actual risk lies in unauthorized manipulation of task data rather than in system compromise.