CVE-2025-71433Published
Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2025-71433 · Microsoft / collected KEV context
cve-program · CVE-2025-71433
- https://github.com/usekaneo/kaneo/issues/521
- https://github.com/usekaneo/kaneo/blob/v2.1.5/apps/api/src/task/index.ts#L252-L275
- https://github.com/usekaneo/kaneo/commit/6d3555e9c07ec7ce7f68477d669eec67fce33cc3
- https://github.com/usekaneo/kaneo/releases/tag/v2.1.6
- https://www.vulncheck.com/advisories/kaneo-before-2.1.6-missing-authorization-allows-cross-workspace-data-access
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.