24 matches found
CVE-2026-52828
Kimai (open-source time tracking application) prior to 2.58.0 contains a missing authorization check in ExportController::createExportTemplate() and ExportController::editExportTemplate(). The methods inherit only the class-level create_export permission, which is granted to ROLE_TEAMLEAD by defa...
CVE-2026-52828 Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access
Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate and ExportController::editExportTemplate inherit only the class-level createexport permission, which ROLETEAMLEAD receives by default, and omit the createexporttemplate permission required b...
CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility
Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...
CVE-2026-52819 Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users target identifiers from a caller with viewothertimesheet but does not apply accessuser or verify that a ROLETEAMLEAD requester leads a team containing each target user...
CVE-2026-52819
Kimai, an open-source time tracking application, is vulnerable to an authorization bypass in its GET /api/timesheets list endpoint (prior to 2.57.0 ). The cgetAction() method accepts user/users[] parameters and adds resolved users to the query without verifying the requester is teamlead of a team...
CVE-2026-80195 Kimai before 2.63.0 Team Membership Removal via API
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint PATCH /api/teams/id, which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead or other user with permission to edi...
PT-2026-60095
Summary The ExportController web routes for creating and editing export templates are gated only by the class-level create export permission, which is granted to ROLE TEAMLEAD by default. The corresponding API routes and UI button visibility correctly require the stricter create export template...
Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
Summary GET /api/timesheets?user= and users= returns the targeted user's timesheet records to any caller that has the viewothertimesheet permission, without verifying that the caller is teamlead of any team containing the target user. The per-record endpoint GET /api/timesheets/id correctly...
GHSA-4M8Q-55QV-9PWP Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target
Summary GET /api/timesheets?user= and users= returns the targeted user's timesheet records to any caller that has the viewothertimesheet permission, without verifying that the caller is teamlead of any team containing the target user. The per-record endpoint GET /api/timesheets/id correctly...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the cgetAction process of the timesheet API endpoint, which fails to properly enforce teamlead authorization checks when accessing other users' timesheet records. An attacker can access sensitive timesheet dat...
PT-2026-60079
Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...
PT-2026-60086
Summary GET /api/timesheets?user= and users= returns the targeted user's timesheet records to any caller that has the view other timesheet permission, without verifying that the caller is teamlead of any team containing the target user. The per-record endpoint GET /api/timesheets/id correctly...
EUVD-2023-34870
Malicious code in bioql PyPI...
CVE-2023-30453
The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter...
CVE-2023-30453
The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter...
CVE-2023-30453
The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter...
CVE-2023-30453
The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter...
Cross site scripting
The Teamlead Reminder plugin through 2.6.5 for Jira allows persistent XSS via the message parameter...
CVE-2023-30453
The CVE-2023-30453 entry concerns the Teamlead Reminder plugin for Jira up to version 2.6.5. The vulnerability is a persistent XSS via the message parameter, allowing injected scripts to be executed in the victim’s browser. Documented impact is client-side script execution potentially leading to ...
