Kimai 2.56.0 and earlier versions expose GET endpoints for default team creation shortcuts that perform persistent writes altering authorization structures. An attacker can exploit this authenticated CSRF vulnerability by tricking a logged-in user with appropriate permissions into visiting a malicious page, causing unauthorized creation or reuse of teams, assignment of the victim as teamlead, and binding of projects, customers, or activities to those teams. This modifies the authorization topology, impacting visibility, assignment scope, team-based access control, reporting, and potential privilege escalation. The vulnerability affects the routes GET /en/admin/project/{id}/create_team, GET /en/admin/customer/{id}/create_team, and GET /en/admin/activity/{id}/create_team. The issue is fixed by moving these endpoints to API POST methods in versions 2.58.0 and later.

An attacker can remotely alter the authorization structure within Kimai by exploiting this CSRF vulnerability, causing unauthorized changes to teams and permission assignments. This can affect visibility rules, assignment scopes, team-based access control, and reporting, potentially enabling privilege escalation chains. The exploit requires the victim to be logged in with permission to manage the targeted project, customer, or activity. The impact is more severe than a typical CSRF affecting only UI preferences because it changes authorization topology.

Upgrade Kimai to version 2.58.0 or later where the vulnerable GET endpoints have been replaced with API POST endpoints, mitigating the CSRF risk. No additional mitigation is required if the system is updated. Patch status is confirmed by the vendor advisory at https://www.kimai.org/en/security/ghsa-pgcc-vfmc-7cw5.