SB2026081392 - Multiple vulnerabilities in kimai2

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper Enforcement of Behavioral Workflow (CVE-ID: N/A)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to remove all members and teamleaders from a team.

The vulnerability exists due to improper enforcement of behavioral workflow in the team update API endpoint when processing a malformed members payload. A remote user can submit a malformed members value to remove all members and teamleaders from a team.

This bypasses the intended protection in the dedicated member-removal endpoint that prevents direct removal of teamleaders.

2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify admin-only work-contract fields.

The vulnerability exists due to improper access control in the PATCH /api/users/{id}/preferences endpoint when handling submitted user preferences. A remote user can send a crafted API request to modify admin-only work-contract fields.

The issue affects work-contract preferences registered by WorkContractPreferenceSubscriber, while the web interface path for editing these fields is administrator-gated.

3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify team access control assignments.

The vulnerability exists due to improper authorization in team access-management endpoints when handling requests to assign customers, projects, or activities to teams. A remote user can send a specially crafted request to modify team access control assignments.

Exploitation requires edit permission on the team and view permission on the target customer, project, or activity.

Remediation

Install update from vendor's website.

References

• https://github.com/kimai/kimai/security/advisories/GHSA-6rxf-4hh9-pp46
• https://github.com/kimai/kimai/security/advisories/GHSA-5mpc-5cg2-g99r
• https://github.com/kimai/kimai/security/advisories/GHSA-gmm9-hfxg-7v29