Kanboard Releases

Latest: Kanboard 1.2.54 · 29 Aug 2026 - Security fixes Invalidate existing sessions and "remember me" tokens when a user's password changes All users will be signed out once after upgrading because existing sessions do not contain the new password fingerprint Enforce permissions in the project creation handler, including personal project creation and project duplication Verify the task and project relationship when fetching task files and when assigning tags through the API Return only public user fields from API procedures, excluding passwords, two-factor secrets, API access tokens, and other private tokens Reject subtask assignees that do not belong to the project Scope unread notification lookups to the notification owner Scope custom filter changes to the filter's project and owner Validate request tokens for tag, board, and comment actions Validate automatic action parameters by requiring scalar integer IDs, ensuring destination projects are accessible, and ensuring referenced columns, swimlanes, categories, and users belong to the action's project Prevent CSV formula injection by escaping exported values that spreadsheet applications could interpret as expressions Harden the official Docker nginx configuration so that only the application front controllers can execute PHP files Dependencies and build Update docker/login-action from 4.4.0 to 4.6.0 Update actions/stale from 10.4.0 to 11.0.0 Update docker/setup-buildx-action from 4.2.0 to 4.3.0