An improper input validation vulnerability in Kanboard allows remote attackers to escalate their privileges to administrator, posing a severe risk to project management data integrity.

This vulnerability involves improper control of dynamically determined object attributes within the UserInviteController::register() function. An attacker with a valid invite link can inject the role parameter during registration, allowing them to assign themselves administrator privileges without authorization.

Successful exploitation of this flaw grants an attacker full administrative control over the Kanboard instance. This enables unauthorized access to sensitive project data, modification of workflows, and potential system-wide configuration changes. With a CVSS score of 8.8, this vulnerability represents a high-severity risk to organizational data confidentiality and operational integrity.

Immediate Action: Upgrade Kanboard to version 1.2.51 or later to implement the necessary input filtering in the registration process.

Proactive Monitoring: Review user account creation logs and audit existing administrator accounts for suspicious or unauthorized entries.

Compensating Controls: If immediate patching is not feasible, restrict access to the registration endpoint or monitor incoming POST requests for anomalous parameters related to user roles.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Given the potential for complete administrative takeover, organizations utilizing Kanboard should prioritize this update immediately. Ensure that the patch is applied across all instances to prevent unauthorized privilege escalation and protect critical project management infrastructure.