Cpe:2.3:a:kaneo:kaneo:*:*:*:*:*:*:*:*

Authenticated users with restricted roles in Kaneo versions 2.3.12 through 2.12.1 can perform unauthorized task modifications or deletions by exploiting a missing permission check in the bulk task API endpoint.