CVE-2026-33058 - Vulnerability Analysis

Overview

Kanboard < 1.2.51 contains an authenticated SQL injection caused by improper input sanitization in user addition functionality, letting attackers with project user addition permission dump the entire database, exploit requires authenticated user with add user permission.

Severity & Score

Impact

Attackers can dump the entire Kanboard database, exposing all stored data.

Mitigation

Upgrade to version 1.2.51 or later.

References

• https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhh

Social Media Activity(1 post)

/r/netsec

@_r_netsec

Apr 17, 2026

Kanboard Authenticated SQL Injection CVE-2026-33058 Writeup https://0dave.ch/posts/cve-2026-33058/

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner