CVE-2026-80195

Kimai before 2.63.0 has a business logic / improper authorization flaw in the team update API endpoint (PATCH /api/teams/{id} ). The endpoint deletes all existing team membership rows before validating the submitted replacement member list. An authenticated user with team-edit permission can ther...