Skip to content
OpenAdvisories

Vendor

usekaneo

3 known vulnerabilities.

Products

kaneo 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.4
    CVE-2026-125329

    Kaneo: Gitea integration access token and webhook secret exposed to any workspace member

    Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including …

    usekaneo kaneo
  • High 7.5
    CVE-2025-71433

    Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access

    Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, …

    usekaneo kaneo
  • High 8.1
    CVE-2026-63104

    Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

    Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that om…

    usekaneo kaneo