Executive brief
Kimai is an open-source time-tracking application used by businesses to manage projects and billing. A security flaw in the application's programming interface (API) allows users with 'Teamlead' privileges to view financial invoices belonging to any customer in the system, even those outside their assigned team. This could lead to the unauthorized exposure of sensitive financial data, including billing amounts and customer details, potentially damaging business confidentiality in multi-tenant environments.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `GET /api/invoices/{id}` endpoint of Kimai. While the endpoint correctly verifies that a user has the `view_invoice` role, it fails to validate if the user has specific 'access' permissions for the customer associated with the requested invoice. This check is present in the web-based controller but missing in the API controller (`src/API/InvoiceController.php`). An attacker with `ROLE_TEAMLEAD` credentials can exploit this by providing an invoice ID in the API request to bypass team-based data isolation and retrieve sensitive financial records. The vulnerability is addressed in version 2.51.0.
Affected products
- Kimai Kimai <= 2.50.0
Timeline
- 2026-03-04: disclosed
- 2026-03-04: advisory
- 2026-03-04: patched: Fixed in version 2.51.0