Kanboard versions 1.2.52 and prior contain a server-side request forgery (SSRF) vulnerability that allows authenticated attackers to bypass SSRF protections. The bypass is achieved by supplying hexadecimal IP address notation in user-controlled URLs through the web link creation feature. The root cause lies in the isPrivateURL() filter in app/Core/Http/Client.php, which relies on PHP's FILTER_VALIDATE_IP that rejects non-dotted-decimal notation, causing hexadecimal IPs to be incorrectly treated as safe. Once bypassed, cURL resolves and connects to internal network resources including cloud instance metadata services (e.g., AWS IMDSv1), localhost services, and RFC1918 private addresses. This vulnerability poses a significant risk in cloud-hosted environments where metadata services may expose sensitive credentials or configuration data. Authenticated users with minimal privileges can exploit this to pivot into internal infrastructure.