Description

Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T12:17:17.733Z",
  "pubdate": "2026-09-02T12:17:17.733Z",
  "executiveSummary": "Kimai versions up to 2.65.0 contain a critical improper authorization vulnerability within its team management API endpoints. The flaw resides in the logic used to link entities—specifically customers, projects, and activities—to existing teams. By exploiting the naming collision mechanism in the POST endpoints for team association, an authenticated user possessing project management permissions can hijack administrative control over pre-existing teams.\nThis vulnerability allows an attacker to escalate privileges by granting themselves 'teamlead' status over teams they are not authorized to manage. The impact is significant, as it grants unauthorized users administrative oversight of organizational entities, potentially leading to unauthorized data access, modification of project workflows, or manipulation of financial records associated with customers and activities. Exploitation requires authenticated access with standard project-management privileges, meaning the attack vector is strictly internal or requires compromised user credentials. The primary risk lies in the bypass of access control checks during team association, effectively violating the principle of least privilege within the Kimai environment. The issue is resolved in version 2.65.0, and immediate patching is recommended to prevent unauthorized escalation of administrative rights.",
  "technicalDetails": "The vulnerability originates from a flawed implementation of business logic within the team association endpoints: POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team. The application fails to validate the authorization context of the authenticated user before modifying the membership or management status of a team identified by name.\nIn Kimai, the system architecture allows for the linking of business entities (Customers, Projects, and Activities) to Teams. When a user invokes one of the aforementioned API endpoints, the application logic performs a lookup based on the provided team name. If a team exists with that specific identifier, the system attempts to associate the target entity (e.g., project) with the existing team. The critical failure occurs because the backend does not enforce an authorization check to verify if the requesting user possesses administrative rights over the discovered team before applying changes.\nThe attack flow proceeds as follows: First, an authenticated attacker with standard project-permission management privileges identifies a target team that they intend to control. Second, the attacker utilizes the vulnerable POST endpoints by specifying the name of the target team during the association process with a customer, project, or activity under the attacker's management. Third, because the system assumes that 'creating' or 'associating' an entity with a team of a specific name permits the user to take control, the application automatically assigns the attacker the 'teamlead' role for that team. This role carries administrative privileges over that team's scope.\nBecause the application logic prioritizes the existence of the name over the permission validation of the user, it effectively bypasses the intended access control lists (ACLs). This allows an attacker to gain elevated, unauthorized access to resources and administrative workflows belonging to other teams within the organization. The vulnerability represents an Insecure Direct Object Reference (IDOR) style logic error combined with a failure in privilege verification. The scope of the impact includes any entity reachable via these API endpoints, allowing the attacker to traverse and control various organizational silos as long as they possess the ability to invoke the team association API with a valid, existing team name."
}