API request could remove all members from a team

Affected versions

Kimai versions <= 2.62.0 are affected by this security issue
The issue has been fixed in Kimai 2.63.0
Severity: Low
We have not requested an official CVE ID for this security advisory

Description

A bug in Kimai’s API allowed users with team editing permissions to remove all members — including team leaders — from a team. This could disrupt team-based access controls and block affected users from reaching their assigned data.

Who is affected: Any user with permission to edit teams
What happened: When updating a team through the API with invalid member data, Kimai removed all existing team members before checking whether the replacement list was valid. If the new list was invalid, Kimai returned an error — but the original members had already been deleted.
Bypassed safeguard: This circumvented a protection that normally prevents the removal of team leaders through the dedicated member-removal endpoint.
Impact: Affected teams could be left without any members or leaders, cutting off access to customers, projects, activities, and timesheets assigned to that team.

Why we didn’t request a CVE

The manipulated teams is annoying, but no business data can be tampered with, no records are created, modified, or deleted, and no information is disclosed. At worst, this is an annoyance for the affected teams/users, which does not meet the threshold for a CVE.

Solution

Kimai now validates the replacement member list before making any changes to the existing team membership. If the submitted data is invalid, the original team members remain unchanged.

Users should update to 2.63.0 or newer.

Credits

Reported by: mattmumford-git
Patched by: kevinpapst

First reported in GitHub advisory: GHSA-6rxf-4hh9-pp46