---
id: CVE-2026-63104
title: >-
  Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization
  vulnerability that allows authenticated workspace members with viewer or
  member roles to delete and modify tasks beyond their assigned permissions by
  exploiting the bulk…
summary: >-
  Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization
  vulnerability that allows authenticated workspace members with viewer or
  member roles to delete and modify tasks beyond their assigned permissions by
  exploiting the bulk…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-862
vendor: usekaneo
product: kaneo
affected:
  - kaneo >= 2.3.12 < 2.12.2
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:53:07.383'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63104'
references:
  - url: 'https://github.com/usekaneo/kaneo/releases/tag/v2.12.2'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/usekaneo/kaneo/security/advisories/GHSA-gx46-mfgj-vm86'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/kaneo-missing-authorization-via-bulk-task-endpoint
    label: disclosure@vulncheck.com
  - url: 'https://github.com/usekaneo/kaneo/security/advisories/GHSA-gx46-mfgj-vm86'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T19:43:43.925311Z'
ingestedAt: '2026-09-22T20:10:15.097Z'
epss: 0.00488
epssPercentile: 0.41116
---

## Overview

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks. Attackers can send requests to the PATCH /api/task/bulk endpoint, which verifies only workspace membership without calling the role-based permission check enforced on all other task endpoints, to permanently delete all tasks or modify task status, priority, assignee, due date, and labels in a workspace.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.