CVE-2025-71433

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/usekaneo/kaneo/blob/v2.1.5/apps/api/src/task/index.ts#L252-L275
https://github.com/usekaneo/kaneo/commit/6d3555e9c07ec7ce7f68477d669eec67fce33cc3
https://github.com/usekaneo/kaneo/issues/521
https://github.com/usekaneo/kaneo/releases/tag/v2.1.6
https://www.vulncheck.com/advisories/kaneo-before-2.1.6-missing-authorization-allows-cross-workspace-data-access
https://github.com/usekaneo/kaneo/issues/521

Configurations

No configuration.

History

15 Oct 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Kaneo versiones anteriores a la 2.1.6 contiene una vulnerabilidad de falta de autorización que permite a usuarios autenticados acceder a otros espacios de trabajo proporcionando identificadores de proyecto, tarea, etiqueta o espacio de trabajo a rutas de API que carecen de comprobaciones de membresía. Los atacantes que obtienen identificadores, por ejemplo de enlaces de proyectos compartidos, pueden leer proyectos y tareas, modificar o eliminar tareas, etiquetas y comentarios, y buscar contenidos del espacio de trabajo.

14 Oct 2026, 18:17

Type	Values Removed	Values Added
References	~~() https://github.com/usekaneo/kaneo/issues/521 -~~	() https://github.com/usekaneo/kaneo/issues/521 -

14 Oct 2026, 15:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-14 15:17

Updated : 2026-10-23 22:10

NVD link : CVE-2025-71433

Mitre link : CVE-2025-71433

CVE.ORG link : CVE-2025-71433

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2025-71433", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-71433", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-14T17:46:05.590608Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/usekaneo/kaneo", "vendor": "usekaneo", "product": "kaneo", "versions": [{"status": "affected", "version": "0", "lessThan": "2.1.6", "versionType": "semver"}], "collectionURL": "https://github.com/usekaneo/kaneo", "defaultStatus": "unaffected"}]}], "published": "2026-10-14T15:17:00.837", "references": [{"url": "https://github.com/usekaneo/kaneo/blob/v2.1.5/apps/api/src/task/index.ts#L252-L275", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/usekaneo/kaneo/commit/6d3555e9c07ec7ce7f68477d669eec67fce33cc3", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/usekaneo/kaneo/issues/521", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/usekaneo/kaneo/releases/tag/v2.1.6", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/kaneo-before-2.1.6-missing-authorization-allows-cross-workspace-data-access", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/usekaneo/kaneo/issues/521", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents."}, {"lang": "es", "value": "Kaneo versiones anteriores a la 2.1.6 contiene una vulnerabilidad de falta de autorizaci\u00f3n que permite a usuarios autenticados acceder a otros espacios de trabajo proporcionando identificadores de proyecto, tarea, etiqueta o espacio de trabajo a rutas de API que carecen de comprobaciones de membres\u00eda. Los atacantes que obtienen identificadores, por ejemplo de enlaces de proyectos compartidos, pueden leer proyectos y tareas, modificar o eliminar tareas, etiquetas y comentarios, y buscar contenidos del espacio de trabajo."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "disclosure@vulncheck.com"}