Kaneo
Monthly
Missing authorization in the Kaneo bulk task endpoint (PATCH /api/task/bulk) allows any authenticated workspace member holding only a viewer or member role to permanently delete every task in the workspace or silently rewrite task status, priority, assignee, due date, and labels - actions that all other task endpoints correctly restrict by role. Affected deployments are Kaneo versions 2.3.12 through 2.12.1 (fixed in 2.12.2). Exploitation requires valid credentials and existing membership in the target workspace (PR:L), no user interaction, and no special configuration; no public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the CVSS 4.0 base score is 7.2 (High) reflecting high integrity and availability impact with no confidentiality loss.
Kaneo project-management installations before 2.1.6 fail to enforce workspace membership on API routes in the task, label, activity, and search modules, so an authenticated user with a valid account on the instance can read, modify, or delete projects, tasks, labels, and comments belonging to other workspaces by simply supplying a foreign project, task, label, or workspace identifier. Exploitation requires both a legitimate authenticated account (CVSS PR:L) and knowledge of valid identifiers from another tenant, which per the source advisory can be harvested out-of-band from shared project links; no user interaction is needed and the flaw is network reachable. Impact is bounded to confidentiality, integrity, and availability of workspace data within the affected instance, and no public exploit code was identified at time of analysis. Multi-tenant or multi-workspace deployments face materially higher exposure than single-workspace instances, and the vendor-released patch is version 2.1.6.
Missing authorization in the Kaneo bulk task endpoint (PATCH /api/task/bulk) allows any authenticated workspace member holding only a viewer or member role to permanently delete every task in the workspace or silently rewrite task status, priority, assignee, due date, and labels - actions that all other task endpoints correctly restrict by role. Affected deployments are Kaneo versions 2.3.12 through 2.12.1 (fixed in 2.12.2). Exploitation requires valid credentials and existing membership in the target workspace (PR:L), no user interaction, and no special configuration; no public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the CVSS 4.0 base score is 7.2 (High) reflecting high integrity and availability impact with no confidentiality loss.
Kaneo project-management installations before 2.1.6 fail to enforce workspace membership on API routes in the task, label, activity, and search modules, so an authenticated user with a valid account on the instance can read, modify, or delete projects, tasks, labels, and comments belonging to other workspaces by simply supplying a foreign project, task, label, or workspace identifier. Exploitation requires both a legitimate authenticated account (CVSS PR:L) and knowledge of valid identifiers from another tenant, which per the source advisory can be harvested out-of-band from shared project links; no user interaction is needed and the flaw is network reachable. Impact is bounded to confidentiality, integrity, and availability of workspace data within the affected instance, and no public exploit code was identified at time of analysis. Multi-tenant or multi-workspace deployments face materially higher exposure than single-workspace instances, and the vendor-released patch is version 2.1.6.