CVE-2026-63104
Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks. Attackers can send requests to the PATCH /api/task/bulk endpoint, which verifies only workspace membership without calling the role-based permission check enforced on all other task endpoints, to permanently delete all tasks or modify task status, priority, assignee, due date, and labels in a workspace.
| CWE | CWE-862 |
| Vendor | usekaneo |
| Product | kaneo |
| Published | Sep 22, 2026 |
| Last Updated | Sep 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for usekaneo kaneo
Be the first to know when new high vulnerabilities affecting usekaneo kaneo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
usekaneo / kaneo
2.3.12 < 2.12.2
References
Credits
Caleb Finley VulnCheck