CyberRota Analysis
AI-GeneratedKimai versions prior to 2.65.0 are vulnerable due to improper permission validation in API endpoints, allowing authenticated users with edit_team permissions to revoke access to activities, projects, and customers without the necessary authorization checks. This flaw could lead to unauthorized access and manipulation of team resources. Organizations using Kimai should prioritize updating to the latest version to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.