CVE-2026-92802: kan through 0.6.0 Authorization Bypass via GitHub Project Import
kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A guest user who lacks the board:create permission can exploit the affected GitHub project import endpoint. The attacker must be able to invoke the importProjects mutation.
Is direct board creation also vulnerable?
No. The available information states that guests remain blocked on direct board creation paths; the authorization bypass occurs through GitHub project import.
What should be restricted if an update is not immediately available?
Restrict guest access to the GitHub project import functionality or otherwise prevent untrusted guest users from invoking the importProjects mutation. This removes the identified bypass path while direct board creation controls remain in place.
How can administrators identify possible exploitation?
Review boards created through GitHub project imports and check whether their creators were guests or lacked board:create permission. Such board creations indicate use of the affected authorization path.