A missing authorization flaw in Kaneo allows authenticated users to perform unauthorized task modifications and deletions, posing a significant risk to data integrity.

The application fails to enforce role-based access control on the PATCH /api/task/bulk endpoint, allowing authenticated workspace members with viewer or member roles to execute unauthorized actions. The system incorrectly verifies only general workspace membership instead of validating specific user permissions for task modification.

Successful exploitation of this vulnerability allows unauthorized users to manipulate or destroy critical project data, leading to significant disruption of business operations. Given the CVSS score of 8.1, this high-severity flaw threatens the integrity of task management systems and could result in the permanent loss of sensitive workspace information.

Immediate Action: Upgrade to Kaneo version 2.12.2 or later, which includes the necessary authorization checks on the bulk task endpoint.

Proactive Monitoring: Review application access logs for unusual patterns of PATCH requests to the /api/task/bulk endpoint, particularly those originating from accounts with viewer or member roles.

Compensating Controls: Implement WAF rules to restrict access to the /api/task/bulk endpoint for non-administrative user roles until the patch can be applied.

Public Exploit Available: exploit_available (unknown)

This vulnerability presents a clear risk to data integrity within the Kaneo platform. Administrators should prioritize updating to version 2.12.2 immediately to prevent unauthorized users from tampering with workspace tasks. Failure to patch may expose project management data to malicious or accidental modification by internal users with limited privileges.