AIKIDO-2026-334881
kimai/kimai is vulnerable to Incorrect Authorization
54
Medium Risk
This Affects:
kimai/kimaiTL;DR
The team access API endpoints for customers, projects, and activities check only view permission on the target entity instead of the permission-management right. An authenticated user with team-editing rights and read-only access to an entity can grant their own team access to that entity. This lets a user expand team access to resources they are not authorized to manage. The fix replaces the view checks with proper permission validation on every entity type.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you grant users team-editing rights together with read-only access to customers, projects, or activities.
Background info
kimai/kimai is vulnerable to Incorrect Authorization in versions 0.0.1 - 2.62.0.
How to fix this
Upgrade the kimai/kimai library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant