CVE-2026-125329: Kaneo: Gitea integration access token and webhook secret exposed to any workspace member

Q: Who can retrieve the exposed Gitea credentials?

Any member of the affected Kaneo workspace can retrieve them, including users assigned the viewer role. The task must have a linked Gitea issue or pull request.

Q: What can an attacker do with the disclosed values?

The exposed Gitea access token can be used for the actions granted to that token. The webhook secret can be used to forge webhook deliveries that pass HMAC verification.

Q: Which deployments are affected?

Kaneo versions before 2.13.0 are affected when a Gitea integration is configured and a task is linked to a Gitea issue or pull request. GitHub integrations and installations without a configured Gitea integration are not affected.

Q: How can I determine whether my workspace may have exposed credentials?

Check whether the deployment runs a version before 2.13.0 and has a configured Gitea integration. Workspaces containing tasks linked to Gitea issues or pull requests could have exposed the integration configuration to any workspace member.

Q: What should be done if exposure is suspected?

Upgrade to Kaneo 2.13.0. Because the access token and webhook secret may have been disclosed, assess the token's granted Gitea permissions and replace the exposed credentials as appropriate.

Published Nov 10, 2026

Updated

Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.

Affected Software

1 affected component

Kaneo Kaneo<2.13.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kaneo to a version that resolves this vulnerability.
Fixed in 2.13.0

Event History

Nov 10, 2026

CVE Published

via MITRE·06:28 PM

Data Sourced

via MITRE·06:28 PM

DescriptionWeakness

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can retrieve the exposed Gitea credentials?

Any member of the affected Kaneo workspace can retrieve them, including users assigned the viewer role. The task must have a linked Gitea issue or pull request.

What can an attacker do with the disclosed values?

The exposed Gitea access token can be used for the actions granted to that token. The webhook secret can be used to forge webhook deliveries that pass HMAC verification.

Which deployments are affected?

Kaneo versions before 2.13.0 are affected when a Gitea integration is configured and a task is linked to a Gitea issue or pull request. GitHub integrations and installations without a configured Gitea integration are not affected.

How can I determine whether my workspace may have exposed credentials?

Check whether the deployment runs a version before 2.13.0 and has a configured Gitea integration. Workspaces containing tasks linked to Gitea issues or pull requests could have exposed the integration configuration to any workspace member.

What should be done if exposure is suspected?

Upgrade to Kaneo 2.13.0. Because the access token and webhook secret may have been disclosed, assess the token's granted Gitea permissions and replace the exposed credentials as appropriate.

CVE-2026-125329: Kaneo: Gitea integration access token and webhook secret exposed to any workspace member

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can retrieve the exposed Gitea credentials?

What can an attacker do with the disclosed values?

Which deployments are affected?

How can I determine whether my workspace may have exposed credentials?

What should be done if exposure is suspected?

Company

Resources

Contact

Frequently Asked Questions

Who can retrieve the exposed Gitea credentials?

What can an attacker do with the disclosed values?

Which deployments are affected?

How can I determine whether my workspace may have exposed credentials?

What should be done if exposure is suspected?