CVE-2025-71433: Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Kaneo user may be able to exploit it. The attacker also needs identifiers for a target workspace or its projects, tasks, or labels; shared project links are one example of how those identifiers could be obtained.
What access could an attacker gain across workspaces?
An attacker can read projects and tasks, search workspace contents, and modify or delete tasks, labels, and comments in another workspace. The issue affects API routes that do not enforce workspace membership checks.
Which Kaneo versions are affected?
Kaneo versions before 2.1.6 are affected. Updating to 2.1.6 or later addresses the reported version range.
How can we assess whether our data may have been exposed or altered?
Review API activity for authenticated users accessing project, task, label, or workspace identifiers belonging to workspaces where they were not members. Pay particular attention to cross-workspace searches and changes or deletions involving tasks, labels, and comments.