Security fixes Disable PHP session upload progress in the Docker image to mitigate CVE-2026-115560. Check that the user can access the opposite task's project before adding internal links with bulk changes. Hide projects the caller cannot access from the API procedures getProjectByName, getProjectByIdentifier, and getProjectByEmail: They now return false instead of a 403 error that revealed the pr…
Security fixes Upgrade the Docker image and runtime configuration from PHP 8.4 to PHP 8.5. The current Alpine package resolves to PHP 8.5.12, which fixes CVE-2026-109618 and CVE-2026-109619. See: https://www.php.net/archive/2026.php#2026-10-21-5
Security fixes Prevent spoofed client IP addresses in trusted-proxy headers from bypassing IP-based CAPTCHA and login lockouts Restrict dashboard and overdue-task queries to projects a user can still access Enforce project authorization when closing board columns, reordering subtasks, and duplicating tasks between projects Require the project-manager role to modify project metadata through the API…
Security fixes Invalidate existing sessions and "remember me" tokens when a user's password changes All users will be signed out once after upgrading because existing sessions do not contain the new password fingerprint Enforce permissions in the project creation handler, including personal project creation and project duplication Verify the task and project relationship when fetching task files a…
Security fixes Scope restriction removal to the authorized project so a project manager can no longer delete restrictions belonging to other projects (ProjectRoleRestrictionModel, ColumnRestrictionModel, ColumnMoveRestrictionModel) Verify that a task belongs to the project before moving it with board drag and drop Validate the destination project in the task move/copy form to prevent reading metad…
Enforce comment visibility rules for public and unauthenticated users: Restricted comments are no longer exposed in public task views. Users cannot create comments with a visibility level higher than their role. Revoke public access tokens for inactive users. Use timing-safe comparisons (hash_equals) for API and webhook token validation to mitigate timing attacks. Replace raw SQL interpolation wit…
Security fixes Add SSRF protection for webhook notifications with the new configuration option WEBHOOK_ALLOW_PRIVATE_NETWORKS Prevent unsafe deserialization in the database session handler Restrict invite signup input to expected fields only to prevent parameter injection Add missing permission checks in several API procedures Validate user external ID values Check file attachment ownership before…
Security Improvements Added missing authorization checks in multiple controllers. Enforced project-level authorization checks where they were missing. Improved plugin security by enforcing installer checks in PluginController actions. Enabled Parsedown safe mode to add an extra layer of protection to Markdown rendering against unsafe content. Added CSRF protection for project role changes and enfo…
Security Fixed an LDAP injection issue by properly escaping placeholders in LDAP queries. Prevented protocol-relative URLs (//example.com) from being used as login redirect targets. Added a new TRUSTED_PROXY_NETWORKS configuration option to explicitly define trusted reverse proxy networks. Introduced an optional security feature to block private network access when fetching external web links (con…
fix: handle Windows-style paths in sanitize_path function feat(locale): added missing German translation phrases feat(locale): added Arabic translation feat(api): add board, rss and ical public links to the API response feat: display sub-tasks completion in numbers (x/y) alongside percentage feat: add basic support for right-to-left (RTL) languages chore: update .gitattributes to ignore additional…
refactor: add namespace to test files fix: the $escape parameter must be provided in PHP 8.4 for CSV functions fix: sanitize and validate uploaded files path fix: do not load RememberMeAuth provider when REMEMBER_ME_AUTH is false fix: avoid PHP warning when external user creation is disabled feat!: remove file cache driver to avoid using unserialize() feat!: ignore legacy events serialized with PH…
refactor: update return type in filter apply methods fix(security): prevent potential Host header injection via SERVER_NAME You must specify the Kanboard application URL explicitly to generate correct URLs from email notifications. The default is http://localhost/. fix: make various PHP 8.x compatibility changes fix: avoid Implicitly nullable parameter declarations errors in PHP 8.4 feat: validate…
refactor: reuse existing helpers in tasks import form fix(filter): handle null input in the Lexer class fix(docker): legacy key/value format with whitespace separator should not be used fix(api): allow and validate creator ID assignment in task creation feat(routes): add view routes for project and task file browsing feat(locale): update all language files using machine translation feat(api): add…
fix: prevent internal task titles from wrapping under the dropdown menu icon feat(locale): update Greek and French translations feat: display tag color squares next to their names in project and global settings feat: enable bulk addition/removal of internal links feat: provide an option to add tags without replacing existing ones during bulk operations
fix: verify the session hasn't expired before returning data fix: avoid PHP 8.4 deprecation notices in third-party libraries fix: avoid Composer warnings regarding PSR compatibility feat(locale): add missing Brazilian Portuguese translations ci: run GitHub Actions tests with ubuntu-24.04 chore: don't export-ignore the ChangeLog build(deps): bump symfony/service-contracts from 2.5.3 to 2.5.4 build(…