CVE-2026-63104 is a high severity (CVSS 8.1) missing authorization flaw in Kaneo, the open source project management tool. In versions from 2.3.12 up to 2.12.2, the bulk task endpoint skips role checks, so viewers can delete or change tasks. Version 2.12.2 fixes it.
What's affected
The record and the GitHub advisory (GHSA-gx46-mfgj-vm86) agree: Kaneo from 2.3.12 up to but not including 2.12.2, patched in 2.12.2. The advisory rates it High. The weakness is CWE-862 (missing authorization).
The bulk task route checks only that the caller belongs to the workspace. Every other task endpoint also checks the caller's role. As a result, a member with the viewer role can delete tasks or change status, priority, assignee, due date and labels, and a member role without delete or assign rights gains them. The advisory says the impact is limited to workspaces the attacker already belongs to.
The vector needs low privileges and has high impact on integrity and availability, with no confidentiality impact.
How to check if you're exposed
Check the Kaneo version you run.
docker ps --format '{{.Names}} {{.Image}}' | grep -i kaneo
If the image tag or release is from 2.3.12 up to 2.12.1, you are on an affected release. Then review workspace membership: how many viewers and members do you have, and do you trust all of them? Anyone with a viewer role could change data before the upgrade.
If you notice missing or altered tasks, compare against a recent backup.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Upgrade Kaneo to 2.12.2 or later.
- Take a backup of the database before you upgrade, and keep it.
- Audit workspace members and remove viewer or member accounts you do not recognise.
- Check for unexpected deleted or reassigned tasks since you installed an affected version, and restore from backup if needed.
- Subscribe to the project's release notifications so the next security fix does not wait.
Why it matters
Authorization has to be checked on every route. When one endpoint, here a bulk variant, takes a shortcut, the roles you set up are not enforced anywhere an attacker chooses to look. Bulk endpoints are an easy place to miss it because they were often added later as a convenience.
The advisory suggests the fix: check permission per operation, with delete needing task delete rights, and so on. The class is CWE-862. The record does not list the CVE as exploited in the wild.
Quick check
Can someone outside my workspace use this?
The advisory says impact is scoped to workspaces the attacker already belongs to. The attacker needs an account with at least the viewer role.
Sources
Last reviewed: 18 October 2026.
