usekaneo kaneo vulnerabilities, newest first

By year: all 2026 2025 2024 2023 2022 2021

1. 8.4CVE-2026-125329EPSS 0.3%2026-11-10

   Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspac…

2. 7.7CVE-2025-71433EPSS 0.6%2026-10-14

   Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who …

3. 7.2CVE-2026-63104EPSS 0.5%2026-09-22

   Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk t…