Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

Kaneo before 2.1.6 lets users see other workspaces

CVE-2025-71433 · published 1 day ago
Summary

If you run Kaneo version older than 2.1.6, a signed‑in user can look at or change data in other workspaces simply by guessing or using IDs that appear in shared links. This could expose projects, tasks, labels and comments to people who should not see them. Update Kaneo to version 2.1.6 or later, or apply the vendor’s fix, to restore proper access checks.

What to do
  • Update usekaneo kaneo to version 2.1.6 or later.
Affected software
VendorProductAffected versions
usekaneo kaneo < 2.1.6
Original advisory text
Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access
Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who obtain identifiers, for example from shared project links, can read projects and tasks, modify or delete tasks, labels and comments, and search workspace contents.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2025-71433 · NVD
CVE-2025-71433 · MITRE
CVE-2025-71433 · OSV
Track software like this
Free during beta