CVE-2026-92802 describes a missing authorization vulnerability in kan through version 0.6.0. The GitHub project import endpoint fails to properly validate permissions for board creation. Specifically, attackers with guest privileges can use the importProjects mutation to create boards despite lacking the board:create permission. This bypass occurs because the mutation does not enforce the same authorization checks as direct board creation methods.

Attackers with guest-level access can create boards without proper authorization, potentially leading to unauthorized resource creation and possible disruption or misuse of the kan project management environment. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict guest user permissions or disable the GitHub project import feature if possible to mitigate unauthorized board creation.