Zexin Yuan 0518a634d6 kanboard: patch CVE-2026-56774 ...

Backport upstream commit 928c68a ("fix(user): scope remember me session
removal to its owner"), which constrains RememberMeSessionModel::remove()
by user_id in addition to the session id. Without it, an authenticated
user can enumerate sequential session ids and delete other users'
(including administrators') persistent "Remember Me" sessions.

Patch can be dropped once kanboard is upgraded past 1.2.52.

CVE-2026-56774 / NIXPKGS-2026-2001

Closes #535589

Assisted-by: Claude-Code:GLM-5.2

2026-07-05 14:28:01 +08:00

..

package.nix

kanboard: patch CVE-2026-56774

2026-07-05 14:28:01 +08:00