SZB-0e3181106a
EUVD-2026-69919: improper authorization in Kimai default team creation endpoints
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Kimai
- Product
- kimai
- First seen
Summary
The EUVD entry, scored 5.3 under CVSS v3.1, describes an improper authorization flaw in Kimai's default team creation endpoints before 2.65.0. The entry says an authenticated user with project permission-management privileges can create or use customer, project, or team objects they should not control.
If you use Kimai
Upgrade Kimai to 2.65.0 or later
Review users who hold project permission-management rights
Audit recently created teams, customers, and projects
What the sources say 1
· Mastodon: “Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints.” Source