PT-2026-113759 · Usekaneo · Kaneo
CVSS v3.1
7.5
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Kaneo versions prior to 2.1.6
Description
Authenticated users can access other workspaces by providing project, task, label, or workspace identifiers to API routes that lack membership checks. This allows attackers who obtain identifiers, such as from shared project links, to read projects and tasks, modify or delete tasks, labels, and comments, and search workspace contents.
Recommendations
Update Kaneo to version 2.1.6 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Kaneo