Is CVE-2026-92802 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92802?

CVE-2026-92802 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-92802

Description

kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking board:create permission. Attackers can bypass authorization checks by using the importProjects mutation to create boards while remaining blocked on direct creation paths.