CVE-2023-33968 Missing Access Control allows User to move and duplicate tasks in Kanboard

Medium 5.4 Published 5 Jun 2023 Updated 8 Jan 2025

Low-privilege users can move or duplicate tasks to unauthorized projects due to missing access control checks in Kanboard.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-33968?

CVE-2023-33968 is a medium-severity missing authorization vulnerability in kanboard, published on 5 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks to any project within the software, even if they have not been invited or the project is personal. The vulnerable features are `Duplicate to project` and `Move to project`, which both utilize the `checkDestinationProjectValues()` function to check his values. This issue has been addressed in version 1.2.30. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-862

Which versions are affected by CVE-2023-33968?

It affects 1 product.

Products include Kanboard Kanboard.

How do I fix CVE-2023-33968?

No fix has been published for CVE-2023-33968 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-33968 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33968 exists.

Sources

Also known as GHSA-gf8r-4p6m-v8vr.