Description
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kimai | kimai | < 2.65.0 | 2.65.0 |
References
- GitHub Security Advisory (GHSA-mc86-77vp-82g3) vendor-advisory
- VulnCheck Advisory: Kimai before 2.65.0 Authorization Bypass via Team Activity API third-party-advisory