CVE-2025-71433
Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access
- State
- Published
- Severity
- 7.7 High
- Published
- Oct 14, 2026
- Updated
- Oct 14, 2026
- Reserved
- Oct 14, 2026
Description
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.7 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
kaneousekaneo |
|
References
- https://github.com/usekaneo/kaneo/issues/521issue-tracking
- https://github.com/usekaneo/kaneo/blob/v2.1.5/apps/api/src/task/index.ts#L252-L275technical-description
- https://github.com/usekaneo/kaneo/commit/6d3555e9c07ec7ce7f68477d669eec67fce33cc3patch
- Kaneo v2.1.6 Release Notesrelease-notes
- VulnCheck Advisory: Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Accessthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.