Cpe:2.3:a:kaneo:kaneo:*:*:*:*:*:*:*:*

Kaneo versions before 2.1.6 contain a missing authorization vulnerability (CVE-2025-71433) allowing authenticated users to bypass membership checks and perform unauthorized operations on arbitrary workspaces.

Authenticated users with restricted roles in Kaneo versions 2.3.12 through 2.12.1 can perform unauthorized task modifications or deletions by exploiting a missing permission check in the bulk task API endpoint.