Tagged kimai

2 posts

2026

2026-08-17

Kimai Guarded the Report and Forgot the Export

Kimai locked its project report behind a permission check and left the export route beside it open. Any logged-in user could download customer names, project names, and budget metadata across every customer. Advisory GHSA-pvc4-crg3-gj44, CVE-2026-80194, patched in 2.64.0.

2026-07-07

One Boolean and You Vanish: A Mass Assignment Fix in Kimai

A ROLE_TEAMLEAD user in Kimai 2.56.0 could set systemAccount:true on their own profile through the user API and disappear from every billing report, every user dropdown, and every teammate's view. One missing permission check. Patched in 2.57.0, credit in the release notes.

kimai mass-assignment cwe-915 access-control responsible-disclosure web-security