CVE-2023-33970 - CVE House

Back to Database

Status published Medium CVE-2023-33970

Missing access control in internal task links feature in Kanboard

5.4 CVSS

Vulnerability Description

Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, which allows a User with the lowest privileges to leak all the tasks and projects titles within the software, even if they are not invited or it's a personal project. This could also lead to private/critical information being leaked if such information is in the title. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-33970

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from kanboard

View All →

Kanboard Path Traversal in File Write via Task File Upload Api

Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events

Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass

Kanboard Password Reset Poisoning via Host Header Injection

Kanboard has stored Cross-site Scripting vulnerability in project name

Affected Vendor

kanboard

View all reports →

Affected Software

kanboard

Vulnerable Versions:

< 1.2.30

Timeline

Official Publish: June 5th, 2023

Last Modified: January 8th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal