Information Disclosure in Kaneo Project Management Application

CVE-2026-125329

What is CVE-2026-125329?

Kaneo, a popular project management application, has an information disclosure issue that impacts versions prior to 2.13.0. This vulnerability allows any member of a workspace, including those with viewer access, to retrieve sensitive information from the integration.config via a GET request to /api/external-link/task/:taskId. Specifically, the configuration may contain critical secrets such as the Gitea accessToken and webhookSecret when a task is associated with a Gitea issue or pull request. This exposure can lead to unauthorized Gitea access and potential exploitation through forged webhook deliveries. The issue has been addressed in version 2.13.0, which mitigates the risk by restricting access to these sensitive tokens.

References