kanboard · Issues· 160 open

[Feature]: `createTaskFile`/`createProjectFile` cannot set the uploader: Add optional `creator_id`

[Bug][Security]: Project authorization is bypassed by identifiers supplied in the request body (3 exploitable instances: cross-project task exfiltration, mass task closure, subtask position write)

[Bug]: http page login not working

getProjectByName/ByIdentifier/ByEmail: distinguishable responses allow probing existence of arbitrary (private) projects

Activity and comment APIs expose other users' email addresses to project members (getMyActivityStream/getProjectActivity/getProjectActivities/getComment/getAllComments)

Revoked project members keep reading assigned tasks via getMyDashboard/getMyOverdueTasks (no membership filter in getUserQuery)

[Security] SSRF: isPrivateURL() bypassed by decimal/hex IPv4 and IPv6-literal hosts (external links & webhooks)

[Bug]: New LDAP-users don't get notifications even if the app settings force this

web-notification-icon class on bell icon isn't removed

Brute-force lockout is keyed on the leftmost X-Forwarded-For value (incomplete fix for CVE-2025-52576)

No rate limiting on two-factor code verification allows TOTP brute-force (TwoFactorController::check)

SSRF protection bypass: bracketed IPv6 literals defeat isPrivateURL() (loopback, RFC1918, cloud metadata)

[Bug]: Problem with notification

[Feature]: I hope to be able to move tasks in bulk (or select all) to other columns

[Bug]: Edit Tasks in Bulk does not work