CVE-2026-80195

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.63.0

Description An improper authorization and business logic issue exists in the 'PATCH /api/teams/{id}' API endpoint. The system removes all current team members before validating the new member list provided in the request. An authenticated user with team editing permissions can send a malformed members payload, causing the system to delete existing membership records even if a validation error is returned. This process bypasses protections that normally prevent the removal of teamleaders, potentially leaving a team without any members or leadership and disrupting access control.

Recommendations Update to version 2.63.0 or later. Avoid using the members parameter in the 'PATCH /api/teams/{id}' endpoint until the update is applied.