Regular users could modify their own work-contract settings through the API

Affected versions

Kimai versions >= 2.61.0, < 2.63.0 are affected by this security issue
The issue has been fixed in Kimai 2.63.0
Severity: Low
A CVE ID is requested, pending assignment

Description

Regular Kimai users were able to modify their own work-contract settings through the API, even though these settings are intended to be managed only by administrators.

The web interface correctly restricts editing of these fields to administrators, but one API endpoint did not enforce the same permission check.
No special permissions or configuration beyond the default user role are required.
This vulnerability is related to CVE-2026-40486, which addressed a similar authorization gap for rate-related fields. The work-contract fields were introduced later and not covered by that earlier fix.
Only Kimai installations running version 2.61.0 or 2.62.0 did expose these fields through the API.

Solution

The fix applies the same permission check used by the web interface to the API endpoint, ensuring that work-contract preferences can only be modified by users with the appropriate administrator-level contract permission.

Users should update to 2.63.0 or newer.

Credits

Reported by: Muhammad-Tayab
Patched by: kevinpapst

First reported in GitHub advisory: GHSA-5mpc-5cg2-g99r