AIKIDO-2026-562192
kimai/kimai is vulnerable to Improper Authorization
31
CVE Score
Low
Improper Authorization
TL;DR
The team update API endpoint accepts a members parameter and deletes all existing team member and teamlead rows before validating the submitted replacement list. When a malformed members payload is sent, the request returns a validation error but the membership rows have already been removed, disrupting team-scoped access control. The fix validates the replacement member list before any changes are made so invalid data leaves the existing membership unchanged.
How do I fix this?
Upgrade the kimai/kimai library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your deployment allows non-admin users to edit teams.
Package
Versions
0.0.1 - 2.62.0
Fixed in 2.63.0Background info
kimai/kimai is vulnerable to Improper Authorization in versions 0.0.1 - 2.62.0.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.