---
id: "CVE-2026-125329"
page: "https://infrastack.ai/live/CVE-2026-125329"
kind: "vulnerability"
aliases: ["CVE-2026-125329"]
title: "Kaneo: task API leaks Gitea access token and webhook secret"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gitea", "kaneo", "package", "self-hosted"]
not_affected_if: ["github-only", "no-gitea-integration", "version-2.13.0-or-later"]
published_at: "2026-11-10T19:21:10+00:00"
first_seen_at: "2026-11-10T19:25:14+00:00"
updated_at: "2026-11-10T19:34:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125329", "first_seen_at": "2026-11-10T19:25:14+00:00"}]
exploit_sources: []
---

# Kaneo: task API leaks Gitea access token and webhook secret

Link for people: https://infrastack.ai/live/CVE-2026-125329 (this .md is for agents)

Kaneo, a self-hosted project management app, returns its Gitea integration config, including the access token and webhook secret, to any workspace member. An attacker with a viewer account can use the token for the actions it grants and forge webhook deliveries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Kaneo version in use; it is affected before `2.13.0`.
- Look for a Gitea integration configured on any workspace (GitHub-only setups are not affected, per the description).

## Fix

- Kaneo: upgrade to `2.13.0` or later.

## Timeline

- 2026-11-10T19:25:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125329

## Documents

- [advisory] Vendor advisory: github.com https://github.com/usekaneo/kaneo/security/advisories/GHSA-43pc-xpv9-6566
- [fix] Patch: github.com https://github.com/usekaneo/kaneo/commit/3ac5aa97fd73c930196952eeb0b2fdfd9925ab54
- [fix] Release notes: github.com https://github.com/usekaneo/kaneo/releases/tag/v2.13.0

## From the sources

Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_