From 0518a634d6cd8720919da1864ecae6dbbf9d357a Mon Sep 17 00:00:00 2001
From: Zexin Yuan <git@yzx9.xyz>
Date: Sun, 5 Jul 2026 14:28:01 +0800
Subject: [PATCH] kanboard: patch CVE-2026-56774

Backport upstream commit 928c68a ("fix(user): scope remember me session
removal to its owner"), which constrains RememberMeSessionModel::remove()
by user_id in addition to the session id. Without it, an authenticated
user can enumerate sequential session ids and delete other users'
(including administrators') persistent "Remember Me" sessions.

Patch can be dropped once kanboard is upgraded past 1.2.52.

CVE-2026-56774 / NIXPKGS-2026-2001

Closes #535589

Assisted-by: Claude-Code:GLM-5.2
---
 pkgs/by-name/ka/kanboard/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/ka/kanboard/package.nix b/pkgs/by-name/ka/kanboard/package.nix
index 2984ebb03d8a..b5b33964dc96 100644
--- a/pkgs/by-name/ka/kanboard/package.nix
+++ b/pkgs/by-name/ka/kanboard/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  fetchpatch,
   nixosTests,
   nix-update-script,
   php,
@@ -18,6 +19,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-iI9Dyno1s9P9t7IxfDs5gQUl9yFyu2taXvKY0WnF2Q0=";
   };
 
+  # CVE-2026-56774 / NIXPKGS-2026-2001: scope remember-me session removal to
+  # the owning user so a session row can only be deleted by its owner.
+  # Remove this patch once upgraded past 1.2.52.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1.patch";
+      hash = "sha256-K616dTwAsLJAJMqY+DJjebfi6MV5wSICbd1iy6VynlM=";
+    })
+  ];
+
   dontBuild = true;
 
   installPhase = ''