CVE-2026-63104: Kaneo Auth Bypass Vulnerability

CVE-2026-63104 Overview

CVE-2026-63104 is a missing authorization vulnerability [CWE-862] in Kaneo, an open-source project management platform. The flaw affects Kaneo versions 2.3.12 through versions prior to 2.12.2. Authenticated workspace members holding viewer or member roles can bypass role-based access controls by targeting the bulk task endpoint. The PATCH /api/task/bulk route verifies workspace membership but omits the role-based permission check enforced on other task endpoints. Attackers can delete all tasks in a workspace or modify task status, priority, assignee, due date, and labels beyond their assigned role permissions.

Critical Impact

Any authenticated workspace viewer or member can permanently delete or modify all tasks in a workspace, compromising project integrity and availability.

Affected Products

• Kaneo versions 2.3.12 through 2.12.1
• Kaneo project management platform (self-hosted deployments)
• Fixed in Kaneo version 2.12.2

Discovery Timeline

• 2026-09-22 - CVE-2026-63104 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-63104

Vulnerability Analysis

Kaneo enforces role-based access control on task operations to restrict destructive actions to users with appropriate workspace roles. Individual task endpoints call a permission check that validates both workspace membership and role. The bulk task endpoint at PATCH /api/task/bulk skips this second check. It only verifies that the requester belongs to the workspace.

The result is a broken access control failure. A user assigned the viewer role, whose intended capability is read-only, can issue a bulk request that mutates or removes tasks. The vulnerability is exploitable over the network with low privileges and no user interaction, and it directly impacts integrity and availability of workspace data.

Enterprises using Kaneo for issue tracking or project delivery face data loss risk from insiders, guest collaborators, or accounts compromised through phishing. The patched release 2.12.2 restores the missing role validation on the bulk endpoint.

Root Cause

The root cause is missing authorization logic on a specific API route. The bulk task handler calls the workspace membership guard but does not invoke the role-based permission function used by all other task endpoints. This is a classic inconsistent enforcement pattern where a shared authorization helper is not applied uniformly across handlers.

Attack Vector

An attacker requires a valid Kaneo account with viewer or member access to a target workspace. The attacker then sends a crafted PATCH request to /api/task/bulk containing task identifiers and mutation payloads. The server accepts the request because membership is confirmed, and executes deletions or field updates that the role should not permit. No user interaction is required, and no additional privileges are needed beyond the initial workspace membership.

Refer to the GitHub Security Advisory GHSA-gx46-mfgj-vm86 and the VulnCheck Advisory on Kaneo for additional technical detail.

Detection Methods for CVE-2026-63104

Indicators of Compromise

• Unexpected PATCH requests to /api/task/bulk originating from accounts with viewer or member roles.
• Sudden bulk deletions or mass field updates on tasks within a workspace over a short time window.
• Audit log entries showing task state changes performed by users whose role should not permit those actions.

Detection Strategies

• Enable request logging on the Kaneo API gateway and alert on any use of the /api/task/bulk endpoint by non-admin roles.
• Correlate task modification events with the acting user's workspace role to identify privilege mismatches.
• Baseline normal bulk task activity per workspace and flag deviations in volume, timing, or actor identity.

Monitoring Recommendations

• Forward Kaneo application logs and reverse proxy access logs to a centralized analytics platform for retention and query.
• Retain database snapshots or task-level audit history to support incident reconstruction and recovery.
• Monitor for account creation and role assignment changes that could stage abuse of the bulk endpoint.

How to Mitigate CVE-2026-63104

Immediate Actions Required

• Upgrade Kaneo to version 2.12.2 or later on all self-hosted instances.
• Review workspace membership and revoke access for accounts that no longer require it.
• Audit recent task deletions and modifications to identify any activity performed by viewer or member accounts.

Patch Information

The vulnerability is fixed in Kaneo v2.12.2. Release notes and the fixed build are available at the Kaneo GitHub Release v2.12.2. Administrators should apply the update, restart the service, and verify the deployed version.

Workarounds

• Restrict network access to the Kaneo API using a reverse proxy or web application firewall rule that blocks or requires elevated authentication for PATCH /api/task/bulk.
• Temporarily limit workspace invitations to trusted users only until the upgrade is completed.
• Take regular database backups of task data so that bulk deletions can be reversed if abuse occurs.

# Example WAF rule to block the vulnerable endpoint until patched
# NGINX snippet
location = /api/task/bulk {
    if ($request_method = PATCH) {
        return 403;
    }
    proxy_pass http://kaneo_upstream;
}