CVE-2026-127215
Kanbanz WordPress Plugin < 1.0.3 Broken Access Control via admin-ajax Handlers
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows authenticated Kanban Staff users to access and modify boards they are not members of by exploiting admin-ajax handlers that fail to call kanbanz_user_can_access_board() or per-task edit checks on attacker-supplied board_id or task_id parameters. Attackers can supply arbitrary board IDs to read sensitive task data, overwrite status columns, subtasks, and labels, inject comments, upload or delete attachments, and create tasks or set WIP limits on boards owned by other teams.
| CWE | CWE-639 |
| Vendor | softaculous |
| Product | kanbanz |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for softaculous kanbanz
Be the first to know when new high vulnerabilities affecting softaculous kanbanz are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
Softaculous / Kanbanz
0 < 1.0.3
References
Credits
🔍 buiih