Description

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T12:17:17.593Z",
  "pubdate": "2026-09-02T12:17:17.593Z",
  "executiveSummary": "Kimai versions prior to 2.63.0 are susceptible to an improper authorization vulnerability located within team access endpoints.\nThe vulnerability allows authenticated users possessing limited 'team edit' permissions—typically restricted to read-only access—to maliciously elevate their privileges or modify access control configurations for protected entities.\nBy manipulating requests to specific team access endpoints, an attacker can grant unauthorized team access to resources including customers, projects, and activities.\nThe risk implication is a significant breach of data confidentiality and integrity, as attackers can bypass intended permission boundaries to access or manage entities outside of their authorized scope.\nExploitation requires the attacker to be authenticated with standard team edit capabilities, removing the requirement for administrative or highly elevated privileges to perform these unauthorized operations.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure authorization check within the team access management logic of the Kimai application. While the system implements role-based access control, the specific team access endpoints fail to adequately validate whether the authenticated user maintains sufficient ownership or management permissions over the target entity during the execution of POST requests.\nWhen a user interacts with the team access modification interface, the application processes requests designed to update Access Control Lists (ACLs). Due to insufficient server-side verification of user permissions against the requested resource, the application logic incorrectly trusts the client-side request parameters. This allows a user with base-level team edit permissions to perform operations that should be strictly reserved for high-level managers or administrators.\nThe attack flow proceeds as follows: First, the attacker identifies a target resource—such as a customer profile, project, or activity—that is currently restricted or outside their authorized access scope. Second, the attacker crafts a POST request targeting the team access endpoint responsible for modifying entity permissions. By manipulating the payload to include identifiers for unauthorized entities and specifying the target team, the attacker triggers an update in the backend database.\nBecause the underlying function lacks a proper security gate to verify the caller's specific permission to modify ACLs for that particular resource, the backend service processes the request and updates the access rights. This successfully grants the attacker's designated team access to the restricted resource.\nThis vulnerability is classified as an improper authorization flaw, specifically within the logic governing team-based permission distribution. The impact is persistent; once the ACLs are modified, the newly granted access remains active until manually reverted by an administrator. This facilitates unauthorized data harvesting, unauthorized project modification, or the illicit sharing of proprietary activity logs across the application. The vulnerability is exploitable over the network by any authenticated user with team editing capabilities, highlighting a failure in granular permission enforcement across the application's RESTful endpoints."
}