Devzephyr

Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using placeholder table syntax in POST /api/v1/query. Attackers can submit queries with FROM {database.table} expressions, including within subqueries, to skip table allowlist and tenant filters and expose run metadata and payloads.

**Name of the Vulnerable Software and Affected Versions** Kimai versions prior to 2.64.0 **Description** An authorization failure exists in the `report project view export` export route within the `ProjectViewController`. Because authorization guards are applied to the ` invoke()` function instead of the class level, the export route lacks necessary authorization checks. This allows any authenticated user, including those with only `ROLE USER` and lacking the `project reporting` permission, to download the project overview export. This action discloses customer names, project names, currency, budget type, and aggregate totals across all customers, although actual financial figures remain protected. **Recommendations** Update Kimai to version 2.64.0 or later.