Vulnerability details

CVE-2025-71433

usekaneo kaneo

Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access

CVSS 4.0

7.7High

Official description

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.

CVSS scores

Score	Version	Source	Vector
7.7High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
7.5High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
usekaneo	kaneo	v < 2.1.6	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/usekaneo/kaneo/blob/v2.1.5/apps/api/src/task/index.ts#L252-L275 technical-description
https://github.com/usekaneo/kaneo/commit/6d3555e9c07ec7ce7f68477d669eec67fce33cc3 patch
https://github.com/usekaneo/kaneo/releases/tag/v2.1.6 release-notes
https://www.vulncheck.com/advisories/kaneo-before-2.1.6-missing-authorization-allows-cross-workspace-data-access third-party-advisory
https://github.com/usekaneo/kaneo/issues/521 issue-tracking

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-14
Last updated: 2026-10-14
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.57%

Probability of exploitation in 30 days

47.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-862
Missing Authorization