---
id: CVE-2026-56774
title: >-
  Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated
  Session ID
summary: >-
  Kanboard through 1.2.52, fixed in commit 928c68a,
  UserViewController::removeSession fails to validate the session id parameter
  before passing it to RememberMeSessionModel::remove, allowing authenticated
  users to delete other users' Remem…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-639
vendor: kanboard
product: kanboard
affected:
  - kanboard <= 1.2.52
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-25T20:28:52.191725Z'
exploitAvailable: true
published: '2026-06-25'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:21.237Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56774'
references:
  - url: 'https://github.com/kanboard/kanboard/issues/5829'
    label: Researcher Disclosure
  - url: 'https://github.com/kanboard/kanboard/pull/5831'
    label: Pull Request
  - url: >-
      https://github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/kanboard-cross-user-deletion-of-persistent-login-sessions-via-unvalidated-session-id
tags:
  - cve.org
  - exploit-available
epss: 0.00477
epssPercentile: 0.41455
ingestedAt: '2026-11-08T14:51:22.337Z'
---

## Overview

Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users' Remember Me sessions. Attackers can enumerate sequential session IDs and mass-invalidate persistent login sessions of any user, including administrators, forcing re-authentication and causing denial of service.

## Affected

- `kanboard <= 1.2.52`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.