CVE-2026-92802 kanbn CVE debrief

Who should care

kan users and administrators should assess exposure and verify permissions to mitigate this vulnerability. This includes reviewing kan versions, restricting board creation permissions, and monitoring project imports for unauthorized board creation attempts. Security teams and platform administrators should prioritize this vulnerability due to its potential impact on kan deployments and the ease of exploitation via the GitHub project import endpoint.

Why it matters

CVE-2026-92802 allows guests to create boards in kan through 0.6.0 via GitHub project import despite lacking permissions. Defenders should verify kan versions, restrict permissions, and monitor imports.

• Verification of board creation permissions is required
• Potential for unauthorized board creation exists
• Monitoring for suspicious project imports is necessary

Technical summary

The kan project through version 0.6.0 has a vulnerability in its GitHub project import endpoint. This endpoint fails to properly validate board creation permissions, allowing guests to create boards even if they lack the board:create permission. This can be exploited by using the importProjects mutation, effectively bypassing direct creation path restrictions. The vulnerability highlights the importance of proper permission validation in project import endpoints to prevent unauthorized board creation. kan users should review and update their deployments to mitigate this issue.

Defensive priority

Medium priority for kan users

Recommended defensive actions

• Review and update kan to version beyond 0.6.0 if possible
• Restrict board creation permissions to authorized users
• Monitor project imports for unauthorized board creation attempts
• Verify kan versions and configurations
• Assess exposure and adjust permissions
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

CVE-2026-92802 details a vulnerability in kan through 0.6.0 where guests can create boards via the GitHub project import endpoint despite lacking board:create permission. This issue arises from improper validation of board creation permissions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.