CVE-2026-52825: Improper Authorization

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

PT-2023-25337 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from a failure to properly check authorization for the "POST /api/v4/teams" endpoint when a team override scheme ID is passed in the request. This allows an authenticate...