Product
Authenticated users with restricted roles in Kaneo versions 2.3.12 through 2.12.1 can perform unauthorized task modifications or deletions by exploiting a missing permission check in the bulk task API endpoint.