CVE-2025-71433

7.5High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-862

Impact

Authenticated attackers can view, modify, or delete cross-workspace tasks, projects, labels, and comments. They need valid credentials to the Kaneo instance and knowledge of target object identifiers, such as from shared links.

Root cause

API routes lack proper workspace membership verification when processing task, project, and label identifiers.

Affected systems

Kaneo before 2.1.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Kaneo to version 2.1.6 or later. No workaround or configuration mitigation is documented; restrict network access to trusted users until patched.

shell

$ git fetch --tags && git checkout v2.1.6

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.

References

Source: nvd.nist.gov/vuln/detail/CVE-2025-71433