Threats tagged 'ghsa-xv4r-4885-gwpg'

Kimai contains an authenticated improper authorization vulnerability in its Team Member and Team Activity Assignment APIs. A Teamlead who can edit their own team can add users or activities outside their authorized scope via backend API calls, bypassing frontend restrictions. This occurs because the backend only checks if the user may edit the team, without verifying if the referenced user or activity is within the Teamlead's legitimate management scope. This can lead to unauthorized expansion of team membership and activity assignments beyond intended visibility.