PT-2026-33218

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.53.0 Description A Mass Assignment and Broken Object Property Level Authorization issue exists in the User Preferences API. The endpoint '/api/users/id/preferences' fails to check the isEnabled flag on preference...

2023 OWASP Top-10 Series: API3:2023 Broken Object Property Level Authorization

Welcome to the 4th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API3:2023 Broken Object Property Level Authorization. In this series we are taking an in-depth look at each category – the detail...