Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2025-71433Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access

High 7.5

In plain English

A high-severity missing authorization in kaneo from usekaneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 52.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.

Affected products (as reported)

Vendor	Product	Versions
usekaneo	kaneo	0 – before 2.1.6

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/usekaneo/kaneo/issues/521 issue-tracking
https://github.com/usekaneo/kaneo/blob/v2.1.5/apps/api/src/task/index.ts#L252-L275 technical-description
https://github.com/usekaneo/kaneo/commit/6d3555e9c07ec7ce7f68477d669eec67fce33cc3 patch
Kaneo v2.1.6 Release Notes release-notes
VulnCheck Advisory: Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access third-party-advisory