Kaneo: Gitea token and webhook secret exposed to workspace members

Upgrade to Kaneo 2.13.0 or later. If you ran a Gitea integration on an older version, treat its secrets as leaked, even after upgrading.

1. Upgrade Kaneo to 2.13.0 or later.
2. Revoke the Gitea personal access token the integration used and create a new one.
3. Rotate the Gitea webhook secret.
4. Reconfigure the integration in Kaneo with the new values.
5. If you cannot upgrade yet, remove the Gitea integration. That clears the exposed config, but also turns the integration off.

Rotation matters most on instances where not every workspace member is fully trusted, for example with open registration or outside collaborators.

Kaneo links tasks to issues and pull requests in Gitea. The Gitea integration stores its settings, including a Gitea personal access token (accessToken) and the secret used to sign inbound webhooks (webhookSecret), as plaintext JSON in the config column of the integration table. Before 2.13.0, GET /api/external-link/task/:taskId loaded each external link with its whole integration row attached and returned it as is. The route only checked that the caller was a member of the task's workspace, so any member, down to the viewer role, could read both secrets by opening any task with a linked Gitea issue or pull request.

Kaneo before 2.13.0, on instances with at least one Gitea integration and at least one task linked to a Gitea issue or pull request. The Gitea integration first shipped in 2.5.0 (2026-04-01), so in practice 2.5.0 through 2.12.2 are affected. Fixed in 2.13.0 (2026-08-05). GitHub integrations are not affected: they store an installationId and no secret. Instances with no Gitea integration are not affected.

• Gitea access token. Anyone holding it can act on the Gitea server with whatever access the token carries. Depending on its scopes, that can include reading private repositories and writing to issues, pull requests or code.
• Webhook secret. Kaneo checks an HMAC signature on inbound Gitea webhooks with this secret. Knowing it lets an attacker forge webhook deliveries that Kaneo accepts as genuine, and so change task state through the integration.
• Low bar. Only workspace membership is needed. The dedicated Gitea integration getter masks the token, but this route bypassed that masking.

Permalinks at 6fc3f44, the parent of the fix commit.

• Route gated on workspace membership only: apps/api/src/external-link/index.ts#L45
• Whole integration row attached to each link and returned: apps/api/src/external-link/index.ts#L49-L61
• Integration config stored as plain text: apps/api/src/database/schema.ts#L782-L795
• Gitea config holds accessToken and webhookSecret: apps/api/src/plugins/gitea/config.ts#L6-L11
• The dedicated getter masks the token, which this route skipped: apps/api/src/gitea-integration/controllers/get-gitea-integration.ts#L44-L46
• Inbound webhooks trusted on the HMAC of webhookSecret: apps/api/src/plugins/gitea/webhook-handler.ts#L95-L101

• 3ac5aa9 ("stop returning integration secrets from the external-link route") makes the route select only the integration id and type, which is all the web client reads, and drops config from the client type. It adds an integration test that a viewer gets neither secret. Released in 2.13.0.
• The fix is still in place on main at 39e7a34, with a code comment warning never to widen the selection.
• Upgrading does not undo a past leak. Rotate the Gitea token and webhook secret as described above.

In Kaneo API logs from before the upgrade, look for GET /api/external-link/task/ requests from accounts that had no reason to view those tasks, especially viewer members or recently added users. On the Gitea side, review activity by the account that owns the integration token for actions Kaneo would not make. Compare Kaneo task changes that came in through Gitea webhooks with the delivery history of the webhook in Gitea; a change with no matching delivery points to a forged request. A working exploit is withheld.

1. 2026-04-01Kaneo 2.5.0 released, the first release with the Gitea integration.
2. 2026-08-05After a private report from Aeon, the maintainer commits the fix (3ac5aa9) and releases Kaneo 2.13.0.
3. 2026-08-05Maintainer publishes GHSA-43pc-xpv9-6566, crediting Aeon as reporter.
4. 2026-10-09We ask for a CVE ID in usekaneo/kaneo#1973; the maintainer requests one from GitHub the same day.
5. 2026-10-09Public write-up.

Finder: Aaron Elijah Mars of Aeon. Tool: Aeon.

• Fix commit: usekaneo/kaneo@3ac5aa9
• Fixed release: Kaneo 2.13.0
• GitHub advisory: GHSA-43pc-xpv9-6566
• CVE: pending (requested from GitHub on 2026-10-09, usekaneo/kaneo#1973)
• Affected repository: usekaneo/kaneo