Devzephyr

**Name of the Vulnerable Software and Affected Versions** Kimai versions prior to 2.64.0 **Description** An authorization failure exists in the `report project view export` export route within the `ProjectViewController`. Because authorization guards are applied to the ` invoke()` function instead of the class level, the export route lacks necessary authorization checks. This allows any authenticated user, including those with only `ROLE USER` and lacking the `project reporting` permission, to download the project overview export. This action discloses customer names, project names, currency, budget type, and aggregate totals across all customers, although actual financial figures remain protected. **Recommendations** Update Kimai to version 2.64.0 or later.