The vulnerability in Kimai (CVE-2026-52825) arises from improper authorization checks in the Team Member and Team Activity Assignment APIs. While the frontend limits user and activity selection based on the Teamlead's scope, the backend API endpoints (`POST /api/teams/{id}/members/{userId}` and `POST /api/teams/{id}/activities/{activityId}`) only verify if the caller can edit the team, not whether the referenced user or activity is within the caller's authorized scope. This allows a Teamlead to add users or activities outside their legitimate management boundaries. The Team voter enforces edit permissions on the team but does not perform secondary checks on the referenced objects. This flaw can cause later authorization logic to trust unauthorized team assignments, potentially expanding access improperly.

An authenticated Teamlead can escalate their privileges by associating users and activities outside their authorized scope to their team. This unauthorized expansion can lead to visibility and management of users and activities that should remain restricted, potentially undermining access controls and data confidentiality within Kimai. The vulnerability affects both team member and activity assignments, with particular risk in activity assignments where subsequent authorization decisions rely on team associations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Teamlead permissions carefully and monitor API usage for anomalous team member or activity assignments. Avoid granting Teamlead roles to untrusted users. Review and enhance backend authorization logic to verify that referenced users and activities fall within the Teamlead's authorized scope before allowing assignments.