Kimai 2.65.0 Permission Bypass in Team Access Removal

Executive Summary

Kimai before version 2.65.0 has an authorization bypass flaw in its Team Activity API. Authenticated users with edit_team permission can revoke team access to activities, projects, and customers without proper permission checks. This allows bypassing authorization controls by not enforcing required permissions_activity, permissions_project, or permissions_customer during revocation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Kimai instance is running a version prior to 2.65.0. Use the command: grep -r '2.65.0' /path/to/kimai/version or check the version in the admin panel. Additionally, monitor API logs for unauthorized revocation attempts of team access to activities, projects, or customers.

Useful 0 Not Useful 0

Impact Analysis

An attacker with edit_team permission could remove team access to critical resources like projects or customers, disrupting workflows or causing data access issues. This could lead to unauthorized changes or loss of access for legitimate users, potentially affecting project management and collaboration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access changes to sensitive data, potentially violating data protection requirements. For GDPR, it may affect access controls for personal data. For HIPAA, it could compromise protected health information access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Kimai to version 2.65.0 or later. If upgrading is not possible, restrict access to users with edit_team permission and monitor their actions closely. Review API logs for suspicious revocation activities and ensure proper permission checks are enforced.

Useful 0 Not Useful 0