Team permission gap could let users grant broader data access than intended

Affected versions

Kimai versions < 2.63.0 are affected by this security issue
The issue has been fixed in Kimai 2.63.0
Severity: Medium
A CVE ID is requested, pending assignment

Description

The team management API did not fully check permissions before letting a team gain access to a customer, project, or activity. A user who could edit a team and had view access to one of these objects could use that combination to add that object record to their team.

The issue required two permissions: “edit team” (by default only Admins) and “view customer”, “view project”, or “view activity”
It was triggered through Kimai’s team-assignment API endpoints, which add a customer, project, or activity to a team
Once assigned, the object’s effective access list changed — other members of that team who previously had no access could gain it
This affects primarily Kimai installations where non-admin users are allowed to edit teams and are granted view-only access to customers, projects, or activities

Solution

The team-assignment endpoints now require the caller to hold the corresponding management permission on the target object: permissions_customer, permissions_project, or permissions_activity

Users should update to 2.63.0 or newer.

Credits

Reported by: mattmumford-git
Patched by: kevinpapst

First reported in GitHub advisory: GHSA-gmm9-hfxg-7v29