CVE-2026-125329

HIGH

MEDIUM Priority: 0.03 BB Relevance: 67/100

Published: 2026-11-10 Modified: 2026-11-10 First seen: 2026-11-10 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network

AC: Low

PR: Low

UI: None

AT: None

VC: High

VI: None

VA: None

Description

Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.