kanboard

v1.2.52 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 2mo Dashboards & Home Pages

✓ No known CVEs patched

This release patches 2 known CVEs

Topics

agile kanban kanboard project-management self-hosted

Summary

AI summary

Timing-safe token comparison, parameterized queries, access token revocation.

Full changelog

Enforce comment visibility rules for public and unauthenticated users:
- Restricted comments are no longer exposed in public task views.
- Users cannot create comments with a visibility level higher than their role.
Revoke public access tokens for inactive users.
Use timing-safe comparisons (hash_equals) for API and webhook token validation to mitigate timing attacks.
Replace raw SQL interpolation with parameterized queries in:
- Task queries (TaskFinderModel)
- iCalendar export conditions
Validate task ownership in bulk operations:
- Ensure tasks belong to the specified project before applying bulk changes.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track kanboard

Get notified when new releases ship.

About kanboard

Kanban project management software