kanboard -- Project Takeover via IDOR in ProjectPermissionController

[email protected] reports:

Kanboard is project management software that focuses on the Kanban
methodology. The vuln is in app/Controller/ProjectPermissionController.php
function addUser(). The users permission to add users to a project
only get checked on the URL parameter project_id. If the user is
authorized to add users to this project the request gets processed.
The users permission for the POST BODY parameter project_id does
not get checked again while processing. An attacker with the
‘Project Manager’ on a single project may take over any
other project. The vulnerability is fixed in 1.2.37.