Editing a team was enough to revoke its access to customers, projects, and activities

Affected versions

Kimai versions < 2.65.0 are affected by this security issue
The issue has been fixed in Kimai 2.65.0
Severity: Low
A CVE ID is requested, pending assignment

Description

When a team’s access to a customer, project, or activity was removed through the API, Kimai only checked that you’re allowed to edit the team — not that you’re allowed to manage the permissions of that customer, project, or activity. Users who can edit teams could therefore take access away from a team and lock its members out of records they need.

This affected the API endpoints that remove a team’s assignment to a customer, project, or activity. The web interface and all other ways of managing teams were not affected.
Granting access through the API correctly required both team edit rights and permission management for the target object. Only the removal was missing the second check.
The only requirement was edit access to the team in question.
The impact is limited to taking access away. Nobody gained additional read or write access, and no timesheets or other records were changed or deleted.
Team members can lose access to the affected customer, project, or activity. A user with the proper permissions can restore the assignment at any time.

Solution

The endpoints that remove a team’s assignment now require the same permission-management check on the target customer, project, or activity that granting the assignment already required. Editing a team alone is no longer enough to revoke its access.

Users should update to 2.65.0 or newer.

Credits

Reported by: ashrexon
Patched by: kevinpapst

First reported in GitHub advisory: GHSA-mc86-77vp-82g3