Authorization Bypass in Kaneo Bulk Task API

Kaneo versions 2.3.12 through 2.12.1 are affected by a critical missing authorization vulnerability, tracked as CVE-2026-63104. The flaw resides within the PATCH /api/task/bulk endpoint, which fails to enforce granular role-based access control (RBAC) checks. While standard task management endpoints correctly validate user permissions based on assigned roles, the bulk endpoint only verifies general workspace membership. This oversight allows workspace members and viewers, who should have restricted access, to execute unauthorized PATCH operations. Exploitation enables these users to modify critical task attributes - including status, priority, assignee, due dates, and labels - or perform bulk deletions of tasks across the entire workspace. This vulnerability represents a significant risk to project integrity and data availability for organizations relying on Kaneo for task management, as it grants restricted users administrative-level control over task lifecycle operations.

Impact

Successful exploitation allows low-privileged users to disrupt project workflows, delete historical task data, and modify sensitive task assignments without authorization. This could result in widespread data loss, project management chaos, and violation of internal security policies regarding task modification privileges. Organizations using Kaneo to track critical business processes or sensitive project roadmaps are at high risk of unauthorized data manipulation.

Recommendation

• Upgrade Kaneo instances to version 2.12.2 or later immediately to resolve the missing authorization check in the API.
• Review web access logs for anomalous PATCH requests to the /api/task/bulk endpoint, specifically monitoring for high volumes of requests originating from users with 'viewer' or 'member' roles.
• Implement request-rate limiting and access controls at the API gateway layer to restrict access to the /api/task/bulk endpoint to authorized project managers or administrators until the patch is applied.