Kaneo: Gitea integration secrets exposed to workspace members
Summary
Kaneo, a project management application with boards and integrations, returns the plaintext configuration of a linked Gitea integration to any workspace member, including viewers. The configuration contains the Gitea access token and webhook secret. An attacker with a valid workspace account can use the token within its Gitea permissions and forge webhook deliveries that pass signature verification. GitHub integrations and installations without a Gitea integration are not affected.
Affected
- Kaneo versions before 2.13.0 with a configured Gitea integration linked to tasks
Fixed in
- Upgrade to Kaneo 2.13.0 or later
Workaround
- If an upgrade is not possible, remove the Gitea integration. This clears the exposed configuration but disables the integration.
Exploitation
- Public proof of concept: none found.
- Known exploitation in the wild: no reports found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- Not listed in CISA KEV.
Our recommendation
- Identify Kaneo instances with a Gitea integration and check their version.
- Upgrade to Kaneo 2.13.0 or later.
- After upgrading, rotate the Gitea access token and webhook secret and treat the old values as compromised.
- Review Gitea audit logs for actions performed by the integration token that Kaneo would not normally perform.
- Review workspace membership, especially viewer and guest accounts, and restrict registration where possible.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-125329 www.cve.org
- GitHub Security Advisory GHSA-43pc-xpv9-6566 github.com
- Kaneo release v2.13.0 github.com
- Fix commit 3ac5aa9 github.com
- Kaneo Gitea integration setup documentation kaneo.app
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:14.
Original description (NVD)
Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.