Executive brief
Kimai, an open-source time-tracking application, contains a security flaw that allows authorized users to modify billing rates for projects, customers, or activities they do not own. By manipulating web requests, a user could change financial configurations belonging to other teams or business domains. This could lead to incorrect invoicing, inaccurate budget reporting, and financial data integrity issues.
Technical details
An improper authorization vulnerability (CWE-285/CWE-639) exists in Kimai <= 2.56.0 within the Web rate editing controllers. The application independently resolves parent objects (Project, Customer, Activity) and child rate objects from URL parameters but fails to verify that the rate actually belongs to the specified parent. An authenticated attacker with permission to edit at least one parent object can provide a valid parent ID they control alongside a rate ID belonging to a different, unauthorized parent. This allows the attacker to bypass scope boundaries and modify billing-related configuration in the database. The issue is addressed in version 2.57.0 by adding parent-child consistency validation.
Affected products
- Kimai Kimai <= 2.56.0
Timeline
- 2026-06-11: disclosed: Initial disclosure by reporter
- 2026-07-14: advisory: GitHub Advisory published
- 2026-07-14: patched: Fix released in version 2.57.0