Kaneo CVE-2026-63104

Exploitation requires an authenticated Kaneo account that is already a member of the target workspace holding a low-privilege viewer or member role (PR:L) - no admin or owner rights are needed. The specific attack surface is the PATCH /api/task/bulk endpoint, which validates workspace membership but does not invoke the role-based permission check applied to all other task endpoints. Affected deployments run Kaneo versions 2.3.12 up to (not including) 2.12.2. No user interaction, no special non-default configuration, and no elevated privileges are required beyond baseline workspace membership; the main limiting factor is that the attacker must possess valid credentials for the workspace.

The signals here are internally consistent and point to a genuine but bounded authorization flaw rather than a critical mass-exploitation event. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H, base 7.2) shows a network-reachable, low-complexity issue requiring only low privileges (PR:L) - matching the description precisely, since the attacker must be an authenticated workspace member holding a viewer or member role. Confidentiality is untouched (VC:N); the entire impact is integrity (VI:H - modifying task status/priority/assignee/due date/labels) and availability (VA:H - permanently deleting all tasks in a workspace). This is CWE-862 (missing authorization): the PATCH /api/task/bulk endpoint checks workspace membership but skips the role-based permission check enforced on every other task endpoint. No EPSS score, KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The flaw was reported by VulnCheck (a credible research source) and a vendor patch exists, which strengthens confidence in the finding's validity. Overall this is a real priority for any team actually running multi-user Kaneo workspaces with untrusted low-privilege members, but the requirement for valid authenticated access plus the niche footprint of the product keep real-world risk moderate rather than urgent.

A user who has been granted only viewer or member access to a Kaneo workspace - someone who should not be able to alter others' work - sends a crafted PATCH request to /api/task/bulk. Because that endpoint verifies only workspace membership and not the caller's role, the attacker permanently deletes every task in the workspace or silently rewrites task status, priority, assignee, due dates, and labels. No public exploit code was provided in the input, but the attack requires only a single authenticated HTTP request (AV:N/AC:L/PR:L/UI:N).