The vulnerability is a missing authorization flaw that allows an authenticated user to perform actions on resources belonging to other workspaces. By supplying identifiers such as project, task, label, or workspace IDs to certain API endpoints that lack membership checks, an attacker can read, modify, delete, or search the contents of workspaces that the user is not a member of. The flaw does not provide direct code execution but enables unauthorized data disclosure and manipulation, thereby compromising confidentiality and integrity of cross‑workspace data.

The affected product is Kaneo by usekaneo, with all releases before version 2.1.6 vulnerable. Users running v prior are exposed to the described privilege escalation.

The CVSS score of 7.7 indicates high severity. Because the flaw requires authentication but no elevated privileges, an attacker who can obtain valid credentials—possibly through social engineering or weak credential handling—can exploit the vulnerability. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet, but the absence of privilege checks makes the attack path straightforward for legitimate users with access.