CVE-2025-71433 Details
Description
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.
A missing authorization vulnerability has been identified in Kaneo versions prior to 2.1.6. This vulnerability allows authenticated users to access workspaces of others by providing project, task, label, or workspace identifiers to API routes that do not enforce membership checks. Attackers can exploit this issue by obtaining identifiers from shared project links, enabling them to read projects and tasks, modify or delete tasks, labels, and comments, and search through workspace contents.
Users are advised to update to Kaneo version 2.1.6 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/usekaneo/kaneo/issues/521 | CISA-ADP | Issue TrackingTechnical DescriptionVendor |
| https://github.com/usekaneo/kaneo/blob/v2.1.5/apps/api/src/task/index.ts#L252-L275 | [email protected] | Source CodeVendor |
| https://github.com/usekaneo/kaneo/commit/6d3555e9c07ec7ce7f68477d669eec67fce33cc3 | [email protected] | Source CodeVendor |
| https://github.com/usekaneo/kaneo/issues/521 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/usekaneo/kaneo/releases/tag/v2.1.6 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/kaneo-before-2.1.6-missing-authorization-allows-cross-workspace-data-access | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kaneo | >= 0, < 2.1.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Translated | [email protected] |
| Oct 15, 2026 | CVE Translated | [email protected] |
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |