CVE-2026-63104

Deferred Deferred - Pending Action

Kaneo Task Deletion and Modification via Missing Authorization

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulnCheck

Description

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks. Attackers can send requests to the PATCH /api/task/bulk endpoint, which verifies only workspace membership without calling the role-based permission check enforced on all other task endpoints, to permanently delete all tasks or modify task status, priority, assignee, due date, and labels in a workspace.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-63104

EUVD

EUVD-2026-84813

Affected Vendors & Products

Vendor	Product	Version / Range
usekaneo	kaneo	From 2.3.12 (inc) to 2.12.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-63104 is a missing authorization vulnerability in Kaneo versions 2.3.12 to 2.12.2. It allows authenticated workspace members with viewer or member roles to delete or modify tasks beyond their permissions by exploiting the bulk task endpoint. The endpoint PATCH /api/task/bulk omits workspace permission checks enforced on other endpoints, enabling unauthorized bulk operations.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized PATCH requests to the /api/task/bulk endpoint. Check logs for bulk delete or modification actions performed by users with viewer or member roles. Use API monitoring tools to track requests violating role-based access controls.

Impact Analysis

Attackers with viewer or member roles can permanently delete all tasks in a workspace or modify task details like status, priority, assignee, due date, and labels. This bypasses normal role restrictions, allowing unauthorized changes within workspaces they belong to.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications or deletions of sensitive task data within a workspace. Unauthorized access to personal or health-related data could lead to violations of confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Kaneo to version 2.12.2 or later to apply the patch. Ensure the bulk task endpoint enforces role-based permissions by adding requireWorkspacePermission checks. Review and restrict workspace membership for users with unnecessary roles.

Hi! I’m here to help you understand CVE-2026-63104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70