Vulnerability · Published Sep 22, 2026 · Assigned by VulnCheck

CVE-2026-63104Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

High 8.1

In plain English

A high-severity missing authorization in kaneo from usekaneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 57.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks. Attackers can send requests to the PATCH /api/task/bulk endpoint, which verifies only workspace membership without calling the role-based permission check enforced on all other task endpoints, to permanently delete all tasks or modify task status, priority, assignee, due date, and labels in a workspace.

Affected products (as reported)

Vendor	Product	Versions
usekaneo	kaneo	2.3.12 – before 2.12.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-gx46-mfgj-vm86) vendor-advisory
Kaneo v2.12.2 Release Notes release-notes, patch
https://www.vulncheck.com/advisories/kaneo-missing-authorization-via-bulk-task-endpoint third-party-advisory