The vulnerability (CWE‑862) allows users authenticated to a workspace but holding only viewer or member permissions to use the bulk task API endpoint to delete or modify tasks that do not belong to them. Because the endpoint skips the normal role‑based permission check, an attacker can permanently remove tasks or change task status, priority, assignee, due date, or labels for all tasks in the workspace, potentially disrupting project tracking and collaboration.

Kaneo installation versions prior to 2.12.2, specifically 2.3.12 and earlier, are affected. The issue is within the usekaneo:kaneo product. Versions 2.12.2 and later contain the fix that restores proper authorization on the bulk task endpoint.

The CVSS score of 7.2 indicates a high severity of missing authorization. EPSS is not available, so current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, but the lack of role enforcement still allows privilege escalation within a workspace. Attackers can exploit the vulnerability by sending authenticated PATCH requests to /api/task/bulk; no additional authentication or system compromise is required beyond workspace membership.