This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-125329 | BDVDB-2026-404644 Detail

usekaneokaneo

Description#

Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.

Impact#

Per CVSS v4.0: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-522 Insufficiently Protected Credentials

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.