LoginSign Up
← Back to all sparks
K

Kanboard

PM
Velocity5.0

Free and open source Kanban project management software focused on simplicity and productivity for small teams.

kanboard.org ↗

Kanboard shipped three security releases in ten days, plus a PHP 8.5 move.

kanbanself-hostedsecurity-hardeningphpdockeropen-source
◆Current state
Kanboard is a self-hosted PHP kanban board whose releases are now almost entirely security work, and October tripled the pace. 1.2.55 blocked spoofed proxy IPs from bypassing CAPTCHA and login lockouts and enforced project authorization across several board actions; 1.2.56 moved the Docker image to PHP 8.5 to pick up two PHP CVE fixes; 1.2.57 disables PHP session upload progress against another CVE and stops API lookups from revealing that inaccessible projects exist. WebP attachments and exact-email user search are the only feature additions.
◆Where it's heading
The audit that ran from LDAP escaping through API response shape is now reaching information leaks by error message: returning false instead of a 403 so the API doesn't confirm a project exists. The Docker image has become part of the security perimeter, with two of the three releases changing PHP runtime settings. Features remain small and incidental.
◆Prediction
Expect further releases tracking upstream PHP and Alpine security fixes, since the Docker image now ships on PHP 8.5 and has needed two runtime changes in ten days.

◆Recent moves

  1. 14d ago

    1.2.57 hides inaccessible projects from API lookups

    Disables PHP session upload progress in the Docker image for a CVE, checks project access on bulk internal links, and makes project lookups return false instead of a revealing 403. The audit is now closing leaks that work through error messages.

    View source ↗
  2. 23d ago

    1.2.56 moves the Docker image to PHP 8.5

    Moves the Docker image from PHP 8.4 to 8.5.12 to pick up two PHP CVE fixes. A runtime bump with no Kanboard code change.

    View source ↗
  3. 24d ago

    1.2.55 blocks proxy IP spoofing and adds WebP attachments

    Stops spoofed trusted-proxy IPs from bypassing CAPTCHA and lockouts, enforces project authorization on column closing, subtask reordering and duplication, and adds WebP attachments. The broadest of October's three security releases.

    View source ↗
  4. 2mo ago

    Password changes now kill sessions; API stops leaking private fields

    The broadest single sweep of the current hardening arc: API procedures now return only public user fields, having previously exposed password data, two-factor secrets and access tokens, and a password change invalidates all sessions and remember-me tokens. Operators should expect every user to be signed out once on upgrade, since existing sessions lack the new password fingerprint. The rest continues the established pattern of per-surface permission and ownership checks.

    View source ↗
  5. 3mo ago

    Security fixes and opt-in full-text task search

    Continues the audit into project-role restrictions and board drag-and-drop, ensuring a project manager cannot delete restrictions belonging to other projects and that a task actually belongs to the project it is moved within. The one real feature is a per-user preference to extend bare search to descriptions and comments, with title-only remaining the default.

    View source ↗
  6. 7mo ago

    Comment visibility rules and timing-safe token checks

    Closes the public and unauthenticated view of comments, so restricted comments are no longer exposed and users cannot post above their role's visibility level. Also replaces raw SQL interpolation with parameterized queries in task finding and iCalendar export, and moves token validation to timing-safe comparison.

    View source ↗