CVE-2017-15203

MEDIUM

Kanboard - IDOR

Title source: rule

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.

Core 4

Core References

Patch, Third Party Advisory x_refsource_misc

Mailing List, Third Party Advisory, VDB Entry x_refsource_misc

Release Notes, Vendor Advisory x_refsource_misc

Patch, Third Party Advisory x_refsource_misc

CVSS v3 4.3

EPSS 0.0054

EPSS Percentile 67.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-639

Status published

Products (46)

kanboard/kanboard 1.0.0

kanboard/kanboard 1.0.1

kanboard/kanboard 1.0.2

kanboard/kanboard 1.0.3

kanboard/kanboard 1.0.4

kanboard/kanboard 1.0.5

kanboard/kanboard 1.0.6

kanboard/kanboard 1.0.7

kanboard/kanboard 1.0.8

kanboard/kanboard 1.0.9

... and 36 more

Published Oct 11, 2017

Tracked Since Feb 18, 2026