CVE-2026-56774

creationtimestamp| type| source ---|---|--- 2026-07-09 16:50:09+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mqa3pfiovd2y...

CVE-2026-56774

Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session...