CVE-2026-32255

The open-source project management tool Kan (versions 0.5.4 and below ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The /api/download/attatchment endpoint fails to perform authentication or URL validation on the user-supplied url query parameter, passing it directly t...