Missing Authorization Vulnerability in Kaneo Affects Data Access

CVE-2025-71433

What is CVE-2025-71433?

Kaneo versions before 2.1.6 exhibit a missing authorization vulnerability, allowing authenticated users to access multiple workspaces. This issue arises when users exploit API routes lacking adequate membership checks, enabling unauthorized access to projects, tasks, labels, and comments. By simply supplying identifiers obtained from shared project links, attackers can read sensitive workspace content and perform unauthorized modifications, posing significant risks to data integrity and confidentiality. Users are advised to upgrade to version 2.1.6 or later to mitigate this vulnerability.

References