Threats tagged 'ghsa-2xgg-2x8h-8xw4'

Kimai version prior to 2.57.0 contains an authenticated improper authorization vulnerability in the web rate editing endpoints for projects, customers, and activities. The flaw allows a user authorized to edit one parent object to manipulate rate records belonging to other unauthorized parent objects by exploiting missing parent-child consistency validation. This can lead to unauthorized modification of billing-related rate configurations across different teams or business domains.