Ashrexon

Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is applied only to the response's available actions.view flag and not to the returned data. As a result, an authenticated user holding only assets.view can enumerate component IDs, names, assigned quantities, and notes that are otherwise protected — the direct GET /api/v1/components/<id> endpoint correctly returns 403 Forbidden for such users.

**Name of the Vulnerable Software and Affected Versions** Kimai versions prior to 2.65.0 **Description** Authenticated users with `edit team` permission can bypass authorization controls when removing team access to activities, projects, and customers via API endpoints. The system fails to perform the necessary `permissions activity` check, allowing users to revoke access without the required authorization. **Recommendations** Update to version 2.65.0 or later.