{"id":"CVE-2026-125329","kind":"vulnerability","aliases":["CVE-2026-125329"],"related":[],"title":"Kaneo: task API leaks Gitea access token and webhook secret","description":"Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.","summary":"Kaneo, a self-hosted project management app, returns its Gitea integration config, including the access token and webhook secret, to any workspace member. An attacker with a viewer account can use the token for the actions it grants and forge webhook deliveries.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitea","kaneo","package","self-hosted"],"not_affected_if":["github-only","no-gitea-integration","version-2.13.0-or-later"],"how_to_check":"- Check the Kaneo version in use; it is affected before `2.13.0`.\n- Look for a Gitea integration configured on any workspace (GitHub-only setups are not affected, per the description).","fix":"- Kaneo: upgrade to `2.13.0` or later.","status":"open","published_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","triaged_at":"2026-11-10T19:34:25+00:00","updated_at":"2026-11-10T19:34:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T19:34:25Z","model":"claude-haiku-5-5","output":{"fix":"- Kaneo: upgrade to `2.13.0` or later.","reach":"network","title":"Kaneo: task API leaks Gitea access token and webhook secret","impact":"medium","summary":"Kaneo, a self-hosted project management app, returns its Gitea integration config, including the access token and webhook secret, to any workspace member. An attacker with a viewer account can use the token for the actions it grants and forge webhook deliveries.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kaneo","self-hosted","gitea"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Gitea token and webhook secret readable by any workspace member","analyst_note":"Product ranges not supplied in the input; the 2.13.0 fix comes from the description text only.","how_to_check":"- Check the Kaneo version in use; it is affected before `2.13.0`.\n- Look for a Gitea integration configured on any workspace (GitHub-only setups are not affected, per the description).\n- unknown for other checks","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["github-only","no-gitea-integration","version-2.13.0-or-later"],"who_is_affected":"Teams that self-host or use Kaneo with a Gitea integration linked to tasks. Any workspace member, including viewer-role users, can read the leaked config. Installations using only GitHub integrations, or with no Gitea integration, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000743,"input_tokens":4706,"output_tokens":545,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125329':13A,16A '-2026':12A,15A '/api/external-link/task':95C '2.13.0':93C,160C 'access':6A,38B 'accesstoken':124C 'account':52B 'action':59B,133C 'affect':153C 'allow':127C 'api':3A 'app':30B 'applic':71C 'attack':48B 'board':73C 'chart':75C 'cloud':89C 'config':35B 'configur':148C 'contain':121C 'cve':11A,14A 'deliveri':65B,137C 'fix':157C 'forg':63B,135C 'gantt':74C 'get':94C 'gitea':5A,17B,33B,113C,123C,132C,149C 'github':77C,142C 'grant':61B,131C 'hmac':140C 'host':22B,27B,84C 'includ':36B,103C 'instal':145C 'integr':34B,78C,143C,150C 'integration.config':98C,120C 'issu':114C,155C 'kaneo':1A,18B,23B,66C 'leak':4A 'link':112C 'manag':29B,70C 'member':46B,102C 'packag':19B 'pass':139C 'plaintext':119C 'prior':91C 'project':28B,69C 'pull':116C 'request':117C 'return':31B,97C 'role':106C 'secret':10A,42B 'self':21B,26B,83C 'self-host':20B,25B,82C 'servic':90C 'task':2A,109C 'taskid':96C 'token':7A,39B,56B,129C 'use':54B,86C 'verif':141C 'version':159C 'viewer':51B,105C 'webhook':9A,41B,64B,136C 'webhooksecret':126C 'without':146C 'workspac':45B,101C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host or use Kaneo with a Gitea integration linked to tasks. Any workspace member, including viewer-role users, can read the leaked config. Installations using only GitHub integrations, or with no Gitea integration, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gitea","high","kaneo","package","selfhosted"],"campaign_type":null,"search_a":"'-125329':13A,16A '-2026':12A,15A 'access':6A 'api':3A 'cve':11A,14A 'gitea':5A 'kaneo':1A 'leak':4A 'secret':10A 'task':2A 'token':7A 'webhook':9A","search_b":"'access':38B 'account':52B 'action':59B 'app':30B 'attack':48B 'config':35B 'deliveri':65B 'forg':63B 'gitea':17B,33B 'grant':61B 'host':22B,27B 'includ':36B 'integr':34B 'kaneo':18B,23B 'manag':29B 'member':46B 'packag':19B 'project':28B 'return':31B 'secret':42B 'self':21B,26B 'self-host':20B,25B 'token':39B,56B 'use':54B 'viewer':51B 'webhook':41B,64B 'workspac':45B","search_c":"'/api/external-link/task':95C '2.13.0':93C,160C 'accesstoken':124C 'action':133C 'affect':153C 'allow':127C 'applic':71C 'board':73C 'chart':75C 'cloud':89C 'configur':148C 'contain':121C 'deliveri':137C 'fix':157C 'forg':135C 'gantt':74C 'get':94C 'gitea':113C,123C,132C,149C 'github':77C,142C 'grant':131C 'hmac':140C 'host':84C 'includ':103C 'instal':145C 'integr':78C,143C,150C 'integration.config':98C,120C 'issu':114C,155C 'kaneo':66C 'link':112C 'manag':70C 'member':102C 'pass':139C 'plaintext':119C 'prior':91C 'project':69C 'pull':116C 'request':117C 'return':97C 'role':106C 'self':83C 'self-host':82C 'servic':90C 'task':109C 'taskid':96C 'token':129C 'use':86C 'verif':141C 'version':159C 'viewer':105C 'webhook':136C 'webhooksecret':126C 'without':146C 'workspac':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-05T16:01:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125329","severity":null,"published_at":"2026-11-10T19:21:10+00:00","modified_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","fetched_at":"2026-11-10T19:25:14+00:00","note":null}],"documents":[{"id":117487,"url":"https://github.com/usekaneo/kaneo/commit/3ac5aa97fd73c930196952eeb0b2fdfd9925ab54","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117488,"url":"https://github.com/usekaneo/kaneo/releases/tag/v2.13.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":117489,"url":"https://github.com/usekaneo/kaneo/security/advisories/GHSA-43pc-xpv9-6566","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-05T16:01:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}