Description

Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead (or other user) with permission to edit a team can submit a malformed members payload; although Kimai returns a validation error, the existing membership rows have already been deleted. This bypasses the dedicated member-removal endpoint's protection against removing teamleaders and can leave a team with no members or teamleaders, disrupting team-based access control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-26T05:18:26.937Z",
  "pubdate": "2026-08-26T05:18:26.937Z",
  "executiveSummary": "Kimai versions prior to 2.63.0 are susceptible to an improper authorization and business logic vulnerability within the team update API endpoint (PATCH /api/teams/{id}).\nThe flaw occurs due to improper state management during the update process, where existing team membership associations are purged from the database prior to the validation of incoming data payloads.\nSuccessful exploitation allows an authenticated user with team edit permissions to trigger a deletion of all existing team members, including protected roles like team leaders, even if the subsequent validation of the new payload fails.\nThis vulnerability compromises the integrity of team-based access control (TBAC) systems, potentially resulting in orphaned teams or the total removal of administrative oversight within a team structure.\nThe attack requires an authenticated session with appropriate authorization to modify team metadata.\nThe risk is categorized as a significant logic flaw that disrupts system operations and access governance.",
  "technicalDetails": "The root cause of this vulnerability lies in the non-atomic execution of the team update operation within the PATCH /api/teams/{id} controller logic. Specifically, the application logic prematurely executes a database-level removal of existing records associated with the team before the integrity of the user-provided 'members' payload is verified.\nThe attack flow begins when an authenticated user, holding the requisite permissions to edit a target team, initiates a PATCH request to the specified API endpoint. The request payload contains a malformed or invalid 'members' data structure designed to trigger a validation failure. Upon receipt, the backend controller proceeds to initiate the update process by first purging all existing entries in the association table linking users to the specific team. This deletion occurs before the application logic proceeds to validate the newly submitted member list.\nWhen the validation logic subsequently encounters the malformed payload, it returns an error response to the client. However, because the deletion of existing members has already been committed to the database state—and not rolled back—the team is left in a corrupted state. This process effectively bypasses the business logic protections implemented in the dedicated member-removal endpoint, which typically enforces safeguards to prevent the removal of the final team leader or administrator.\nThe vulnerability allows an attacker to force a 'denial of service' on team membership access, potentially stripping a team of all its members or leaving it without any administrative oversight. This is particularly critical in environments where access control is strictly enforced via team assignments, as the loss of membership rows can revoke access rights for legitimate users or administrators, thereby disrupting operational continuity.\nThe affected component is the Kimai Team API controller responsible for handling PATCH requests. The issue is present in all versions of Kimai prior to 2.63.0. The exploit does not require specialized network exposure beyond the ability to reach the API endpoint as an authenticated user. The post-exploitation impact includes the permanent loss of membership configuration for the target team, requiring manual administrative intervention to restore the correct team structure."
}