CVE-2025-71433
highKaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label…
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/usekaneo/kaneo/blob/v2.1.5/apps/api/src/task/index.ts#L252-L275 disclosure@vulncheck.com
- https://github.com/usekaneo/kaneo/commit/6d3555e9c07ec7ce7f68477d669eec67fce33cc3 disclosure@vulncheck.com
- https://github.com/usekaneo/kaneo/issues/521 disclosure@vulncheck.com
- https://github.com/usekaneo/kaneo/releases/tag/v2.1.6 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/kaneo-before-2.1.6-missing-authorization-allows-cross... disclosure@vulncheck.com
- https://github.com/usekaneo/kaneo/issues/521 134c704f-9b21-4f2e-91b3-4a467353bcc0