CVE-2025-71433

46th percentile - higher than 46% of all known CVEs

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.

An authenticated user can access data from other workspaces, breaching data isolation and confidentiality. They can also modify or delete other users' tasks, labels, and comments.

Update Kaneo to version 2.1.6 or later. Enforce membership checks in API routes for projects, tasks, labels, and workspaces.