An authenticated administrator can achieve full remote code execution in Kanboard due to a missing authorization check on the plugin installation endpoint.

This is an authorization bypass vulnerability (CWE-863) where the backend endpoint fails to respect the PLUGIN_INSTALLER configuration setting. An authenticated administrator can force the installation of arbitrary plugins to execute code on the server.

The ability to achieve remote code execution represents a critical risk to the confidentiality, integrity, and availability of the entire server environment. With a CVSS score of 8.4, this vulnerability allows a compromised administrative account to gain full control over the application host, potentially leading to unauthorized data access, lateral movement within the network, or complete system compromise.

Immediate Action: Upgrade Kanboard to version 1.2.50 or later to ensure the plugin installation logic correctly respects security configuration settings.

Proactive Monitoring: Monitor server logs for unexpected plugin installations or file modifications within the application directory, particularly following administrative sessions.

Compensating Controls: Ensure administrative access is strictly limited to authorized personnel and implement network-level egress filtering to prevent the application server from reaching untrusted external repositories for plugin downloads.

Public Exploit Available: Yes, two public proof-of-concept repositories are available on GitHub.

Given the potential for remote code execution and the existence of public proof-of-concept code, this vulnerability poses a significant risk to organizations using Kanboard. Administrators must prioritize updating to version 1.2.50 immediately to prevent potential exploitation of the plugin installation mechanism.