{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akaneokaneo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kaneo:kaneo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-63104"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kaneo (2.3.12 - 2.12.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Kaneo"],"content_html":"\u003cp\u003eKaneo versions 2.3.12 through 2.12.1 are affected by a critical missing authorization vulnerability, tracked as CVE-2026-63104. The flaw resides within the PATCH /api/task/bulk endpoint, which fails to enforce granular role-based access control (RBAC) checks. While standard task management endpoints correctly validate user permissions based on assigned roles, the bulk endpoint only verifies general workspace membership. This oversight allows workspace members and viewers, who should have restricted access, to execute unauthorized PATCH operations. Exploitation enables these users to modify critical task attributes - including status, priority, assignee, due dates, and labels - or perform bulk deletions of tasks across the entire workspace. This vulnerability represents a significant risk to project integrity and data availability for organizations relying on Kaneo for task management, as it grants restricted users administrative-level control over task lifecycle operations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows low-privileged users to disrupt project workflows, delete historical task data, and modify sensitive task assignments without authorization. This could result in widespread data loss, project management chaos, and violation of internal security policies regarding task modification privileges. Organizations using Kaneo to track critical business processes or sensitive project roadmaps are at high risk of unauthorized data manipulation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Kaneo instances to version 2.12.2 or later immediately to resolve the missing authorization check in the API.\u003c/li\u003e\n\u003cli\u003eReview web access logs for anomalous PATCH requests to the /api/task/bulk endpoint, specifically monitoring for high volumes of requests originating from users with 'viewer' or 'member' roles.\u003c/li\u003e\n\u003cli\u003eImplement request-rate limiting and access controls at the API gateway layer to restrict access to the /api/task/bulk endpoint to authorized project managers or administrators until the patch is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-22T22:40:12Z","date_published":"2026-09-22T22:40:12Z","id":"https://feed.craftedsignal.io/briefs/2026-09-kaneo-auth-bypass/","summary":"Authenticated users with restricted roles in Kaneo versions 2.3.12 through 2.12.1 can perform unauthorized task modifications or deletions by exploiting a missing permission check in the bulk task API endpoint.","title":"Authorization Bypass in Kaneo Bulk Task API","url":"https://feed.craftedsignal.io/briefs/2026-09-kaneo-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:kaneo:kaneo:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}