CVE-2014-3920: Cross-site request forgery (CSRF) vulnerability in Kanboard before 1.0.6 allows remote attackers to hijack...

Security readout for executives and security teams

Kanboard before 1.0.6 had a CSRF flaw that could let an attacker abuse a logged-in administrator’s browser to add another administrative user. The attacker would need an administrator’s authenticated session and successful user interaction. The sources do not report active exploitation or a CVSS score. Exposure is limited to organizations running Kanboard versions earlier than 1.0.6, especially where administrators use the application in a browser and can be targeted through web or email content. Treat this as a targeted-risk legacy issue. It is not reported as actively exploited, but vulnerable Kanboard systems could allow unauthorized administrator creation if an admin is tricked while logged in. Mitigation focus: Upgrade Kanboard to version 1.0.6 or later.; Check Kanboard vendor guidance and release notes for the definitive fixed version.; Restrict administrative access to trusted networks or VPN where feasible..

Prepared

Jun 14, 2026, 13:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.