CVE-2026-52825
Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility
Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} verify that a teamlead may edit the Team but do not verify access_user for the referenced User or view access for the referenced Activity. A teamlead can add users or activities outside the teamlead's manageable scope to an editable team, bypassing the narrower choices enforced by TeamEditForm and UserRepository::getQueryBuilderForFormType(). The resulting relationships can be trusted by RolePermissionManager::checkTeamAccessActivity() and other team-based authorization, visibility, reporting, and workflow logic. This issue is fixed in version 2.58.0.
| CWE | CWE-285 CWE-862 |
| Vendor | kimai |
| Product | kimai |
| Published | Sep 15, 2026 |
| Last Updated | Sep 15, 2026 |
Get instant alerts for kimai kimai
Be the first to know when new unknown vulnerabilities affecting kimai kimai are published — delivered to Slack, Telegram or Discord.