Read the docs
TI-2025-43914 Aliases CVE-2025-71433GHSA-qrhr-48pv-72cv

Missing authorization in Kaneo exposes other workspaces

Priority HIGH 69CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Kaneo before 2.1.6 has a missing authorization flaw (CWE-862) in API routes that lack membership checks. An authenticated user can access other workspaces by supplying project, task, label or workspace identifiers, and attackers who obtain those identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents. The CVSS 4.0 vector rates the attack as network-reachable with low privileges required and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00572 47th percentileScored 2026-11-07
Fix Fixed kaneo (usekaneo): 2.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
usekaneokaneobefore 2.1.62.1.6Patch availableCNA
  • kaneo Vendorusekaneo Affected before 2.1.6 Fixed in 2.1.6 Patch available CNA

Remediation

Upgrade usekaneo kaneo to version 2.1.6.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA kaneo (usekaneo) Fixed in 2.1.6

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-14 Threatist record created from CVE-2025-71433
  2. 2026-10-14 Alias added: GHSA-qrhr-48pv-72cv
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-15 Priority changed: MEDIUM → HIGH
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Other 3

  • TI-2026-45053 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint CVSS 4.0HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences