5 matches found
CVE-2026-52828
Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate and ExportController::editExportTemplate inherit only the class-level createexport permission, which ROLETEAMLEAD receives by default, and omit the createexporttemplate permission required b...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through insufficient authorization checks in the ExportController web routes for creating and editing export templates. An attacker can gain unauthorized access to create or modify global export templates by direct...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through insufficient authorization checks in the postMemberAction and postActivityAction API endpoints. An attacker can expand their management scope to add users or activities outside their authorized visibility b...
Weak Password Recovery Mechanism for Forgotten Password
Overview Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password through the loginlink process. An attacker can gain unauthorized access to user accounts by reusing a previously issued password reset link after the password has been changed. Thi...
