Threats tagged 'ghsa-pgcc-vfmc-7cw5'

Kimai version prior to 2.58.0 contains an authenticated cross-site request forgery (CSRF) vulnerability in default team creation endpoints accessed via GET requests. These endpoints allow unauthorized modification of team and permission structures by creating or reusing teams, assigning the victim user as teamlead, and binding projects, customers, or activities to those teams without explicit user consent. The vulnerability requires the victim to be logged in with permissions to manage the relevant object. The issue has been addressed by moving these routes to API POST endpoints.