Kimai 2.56.0 and earlier versions have an authorization bypass vulnerability in the editing flows for ProjectRate, CustomerRate, and ActivityRate entities. The web endpoints for editing rates independently resolve the parent object and the rate object from user-controlled parameters but only verify user permissions on the parent object, not that the rate belongs to that parent. This missing validation enables authenticated users to modify rate records outside their authorized scope, breaking team-based isolation for financial configurations. The issue affects the GET/POST routes for project, customer, and activity rate editing. The vulnerability is a cross-scope integrity flaw impacting billing and invoicing data. The vendor fixed the issue by adding validation to ensure the rate belongs to the referenced parent object and rejecting requests otherwise.

Authenticated users with edit permissions on a parent object (project, customer, or activity) can modify rate configurations associated with other unauthorized parent objects. This compromises the integrity of billing-related data such as time-based settlement rates, inherited pricing, cost calculations, budget and revenue reporting, and downstream invoice generation. The vulnerability breaks team-based isolation boundaries for sensitive financial configurations, potentially leading to incorrect billing or financial discrepancies.

A fix is available in Kimai version 2.57.0 and later, which enforces parent-child consistency validation in the rate edit endpoints. Users should upgrade to version 2.57.0 or later to remediate this vulnerability. No additional mitigation steps are required if the system is updated. Patch status is confirmed by the vendor advisory.