Kanboard 1.2.54

Release date: August 28, 2026

Changes

Invalidate existing sessions and "remember me" tokens when a user's password changes
- All users will be signed out once after upgrading because existing sessions do not contain the new password fingerprint
Enforce permissions in the project creation handler, including personal project creation and project duplication
Verify the task and project relationship when fetching task files and when assigning tags through the API
Return only public user fields from API procedures, excluding passwords, two-factor secrets, API access tokens, and other private tokens
Reject subtask assignees that do not belong to the project
Scope unread notification lookups to the notification owner
Scope custom filter changes to the filter's project and owner
Validate request tokens for tag, board, and comment actions
Validate automatic action parameters by requiring scalar integer IDs, ensuring destination projects are accessible, and ensuring referenced columns, swimlanes, categories, and users belong to the action's project
Prevent CSV formula injection by escaping exported values that spreadsheet applications could interpret as expressions
Harden the official Docker nginx configuration so that only the application front controllers can execute PHP files