Description

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T12:17:17.320Z",
  "pubdate": "2026-09-02T12:17:17.320Z",
  "executiveSummary": "Kimai versions prior to 2.65.0 contain a critical authorization vulnerability within its API endpoints, specifically concerning the management of team access permissions.\nThe vulnerability is categorized as an improper access control flaw, where the system fails to enforce required security checks when revoking team associations for activities, projects, or customers.\nAn authenticated user possessing the 'edit_team' permission can unilaterally remove team access to these entities, bypassing the mandatory 'permissions_activity' authorization verification.\nThe primary risk implication is the unauthorized modification of project and activity accessibility, which could lead to data isolation, disruption of workflow, or unauthorized privilege escalation regarding resource management.\nThis vulnerability requires an authenticated session and the 'edit_team' privilege to exploit. It does not require administrative or superuser status, expanding the potential threat surface to any user with standard team-editing capabilities.\nThe impact remains restricted to authenticated actors but allows for significant tampering with permission hierarchies, potentially impacting the confidentiality and integrity of project management data within the Kimai environment.",
  "technicalDetails": "The vulnerability originates from a deficiency in the authorization logic within the Kimai API backend. Specifically, the API endpoints responsible for handling the removal of team associations from project, activity, and customer resources do not correctly implement the secondary authorization checks required to validate user rights relative to those resources.\nWhile the system correctly checks for the 'edit_team' permission—a permission intended for team management—it fails to perform an additional 'permissions_activity' check. This check acts as a secondary gatekeeper to ensure that the user has the necessary administrative or ownership context to modify the specific association being revoked.\nIn a secure state, the application should verify that the acting user has not only the general ability to edit teams but also the explicit authority to alter the security posture of the targeted activity or project. By omitting this check, the API logic effectively grants 'edit_team' holders the ability to perform destructive operations on resource permissions they are not otherwise authorized to manage.\nThe attack flow commences with an authenticated attacker interacting with the vulnerable API endpoints via HTTP requests. The attacker targets the team membership revocation process by sending a request to remove a team's association with a specific project or activity ID. Because the application logic relies solely on the initial 'edit_team' check, the request bypasses the internal security interceptors meant to validate cross-functional permissions.\nUpon successful exploitation, the targeted team loses access to the specified resource immediately. This effectively isolates the team from their assigned work, disrupts tracking, and alters the defined authorization scope of the Kimai instance without appropriate administrative oversight.\nThe vulnerability affects all Kimai versions prior to 2.65.0. It is characterized as a logic error within the API layer, specifically impacting the handling of resource-based access control. The exploitation does not require advanced techniques like memory corruption or SQL injection, but rather exploits the gap between the intended security policy and the actual code-level implementation of access control checks. This allows for persistent, unauthorized modification of the application's internal security configuration by standard authenticated users."
}