Threats tagged 'ghsa-rw46-qg69-vg6h'

Kimai versions prior to 2.58.0 have a missing authorization check in the ExportController web routes for creating and editing export templates. This allows users with the ROLE_TEAMLEAD permission to create or modify global export templates, which should be restricted to administrators. These templates affect the structure and content of exported data visible to all users. The issue violates intended permission boundaries but does not lead to remote code execution or credential exposure.