CVE-2026-92802 kan through 0.6.0 Authorization Bypass via GitHub Project Import
Attackers can bypass authorization checks to create boards as guests, allowing unauthorized data modification in kan project management software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92802?
CVE-2026-92802 is a medium-severity missing authorization vulnerability in kanbn kan, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
Weakness: CWE-862
Which versions are affected by CVE-2026-92802?
How do I fix CVE-2026-92802?
No fix has been published for CVE-2026-92802 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-92802 being exploited?
There is no known exploitation of CVE-2026-92802 in the wild and no public exploit code.
Sources
Also known as GHSA-frgf-wpx9-58c9.