kanboard: patch CVE-2026-56774

Backport upstream commit 928c68a ("fix(user): scope remember me session
removal to its owner"), which constrains RememberMeSessionModel::remove()
by user_id in addition to the session id. Without it, an authenticated
user can enumerate sequential session ids and delete other users'
(including administrators') persistent "Remember Me" sessions.

Patch can be dropped once kanboard is upgraded past 1.2.52.

CVE-2026-56774 / NIXPKGS-2026-2001

Closes #535589

Assisted-by: Claude-Code:GLM-5.2

pkgs/by-name/ka/kanboard/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  fetchpatch,
   nixosTests,
   nix-update-script,
   php,
@@ -18,6 +19,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-iI9Dyno1s9P9t7IxfDs5gQUl9yFyu2taXvKY0WnF2Q0=";
   };
 
+  # CVE-2026-56774 / NIXPKGS-2026-2001: scope remember-me session removal to
+  # the owning user so a session row can only be deleted by its owner.
+  # Remove this patch once upgraded past 1.2.52.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1.patch";
+      hash = "sha256-K616dTwAsLJAJMqY+DJjebfi6MV5wSICbd1iy6VynlM=";
+    })
+  ];
+
   dontBuild = true;
 
   installPhase = ''