CVE-2026-125329 · Package
NO FIX YET · SEE WHAT TO DO
Kaneo, a self-hosted project management app, returns its Gitea integration config, including the access token and webhook secret, to any workspace member. An attacker with a viewer account can use the token for the actions it grants and forge webhook deliveries.
first public Aug 5, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host or use Kaneo with a Gitea integration linked to tasks. Any workspace member, including viewer-role users, can read the leaked config. Installations using only GitHub integrations, or with no Gitea integration, are not affected.
Not affected if github-only, no-gitea-integration, version-2.13.0-or-later
Who cares gitea, kaneo, self-hosted
2.13.0.2.13.0 or later.Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.
This page as ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.