Executive brief
Kimai, an open-source time-tracking application, contains a flaw that allows users to create activities or projects under categories they are not authorized to access. An authenticated user could exploit this to inject data into other teams' projects, potentially disrupting project management, billing rates, and reporting. This could lead to data pollution and business process errors across different departments or clients.
Technical details
An improper authorization vulnerability exists in Kimai's ActivityController and ProjectController. The application fails to verify if an authenticated user has the necessary permissions to associate a new activity with a specific project, or a new project with a specific customer, when using preset identifiers in the URL (e.g., /en/admin/activity/create/{project}). An attacker with basic 'create_activity' permissions can bypass project-level access controls by supplying a valid project ID they do not own. This allows for persistent cross-project object injection. The issue is resolved in version 2.57.0 by implementing 'IsGranted' checks for the parent objects during the creation flow.
Affected products
- Kimai Kimai <= 2.56.0
Timeline
- 2026-06-11: disclosed: Initial disclosure by reporter
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Fix released in version 2.57.0