CVE-2026-92802

Medium CVSS 4.3

Published 2026-09-16 · last changed 2026-09-17

The fix

We hold no Microsoft remediation data for CVE-2026-92802, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.

Sources

NVD record for CVE-2026-92802

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N