Mattmumford-Git

**Name of the Vulnerable Software and Affected Versions** Kimai versions prior to 2.63.0 **Description** An improper authorization issue exists in team access endpoints. Authenticated users possessing team edit permissions but only read-only access can grant team access to customers, projects, or activities. This occurs due to insufficient permission checks when sending POST requests to team access endpoints, allowing the modification of access control lists for entities the user should not be authorized to change. **Recommendations** Update to version 2.63.0 or later.

**Name of the Vulnerable Software and Affected Versions** Kimai versions prior to 2.65.0 **Description** An improper authorization issue exists in the default team creation endpoints. An authenticated user with project permission-management privileges can gain unauthorized team-lead administration rights over an existing team. This occurs when a user creates or uses a customer, project, or activity with a name that matches an existing team. The system reuses the existing team and assigns the current user as the team lead without verifying the necessary authorization. The affected API endpoints are 'POST /api/customers/{id}/team', 'POST /api/projects/{id}/team', and 'POST /api/activities/{id}/team'. **Recommendations** Update Kimai to version 2.65.0.

**Name of the Vulnerable Software and Affected Versions** Kimai versions prior to 2.63.0 **Description** An improper authorization and business logic issue exists in the 'PATCH /api/teams/{id}' API endpoint. The system removes all current team members before validating the new member list provided in the request. An authenticated user with team editing permissions can send a malformed `members` payload, causing the system to delete existing membership records even if a validation error is returned. This process bypasses protections that normally prevent the removal of teamleaders, potentially leaving a team without any members or leadership and disrupting access control. **Recommendations** Update to version 2.63.0 or later. Avoid using the `members` parameter in the 'PATCH /api/teams/{id}' endpoint until the update is applied.