Missing Authorization Vulnerability in Kaneo (CVE-2025-71433)

Kaneo versions prior to 2.1.6 are affected by a missing authorization vulnerability, tracked as CVE-2025-71433. The flaw exists because several API routes lack proper membership verification, enabling an authenticated user to perform unauthorized actions across workspaces they do not belong to. By obtaining valid project, task, label, or workspace identifiers - potentially through leaked links or shared resources - an attacker can bypass existing access controls. This vulnerability allows for unauthorized data exfiltration, including reading projects and tasks, as well as destructive actions such as deleting or modifying tasks, labels, and comments within the victim workspace.

Impact

The vulnerability poses a significant risk to data confidentiality and integrity for organizations using Kaneo. If exploited, an attacker can access sensitive project data, manipulate task workflows, or destroy workspace contents, potentially leading to unauthorized data exposure or operational disruption. The impact is elevated given the ability to perform both read and write operations across restricted workspaces.

Recommendation

• Upgrade Kaneo installations to version 2.1.6 or later immediately to patch CVE-2025-71433.
• Review web application logs for high volumes of unauthorized API requests returning 403 Forbidden statuses, which may indicate an attacker attempting to enumerate valid resource IDs.
• Audit existing project and workspace sharing configurations to ensure sensitive identifiers are not being leaked through public or improperly shared links.