PT-2026-144404

CVE-2026-125329

Published

2026-11-10

Updated

2026-11-10

Description by

CVSS 4.0

8.4

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Kaneo versions prior to 2.13.0

Description An issue exists where the endpoint "/api/external-link/task/:taskId" returns the integration.config to any workspace member, including those with the viewer role, when a task is linked to a Gitea issue or pull request. The integration.config is returned in plaintext and contains the Gitea accessToken and webhookSecret. This allows unauthorized users to perform Gitea actions granted to the token and create forged webhook deliveries that pass HMAC (Hash-based Message Authentication Code) verification, which is a mechanism used to verify the integrity and authenticity of a message.

Recommendations Update to version 2.13.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Aeonframework

Vendors

Affected products

Weakness enumeration

CWE-522: Insufficiently Protected Credentials

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor