Executive brief
Kimai is a time tracking and project management application. A missing authorization check in the project export feature allows any logged-in user to download detailed project information (customer names, project names, budgets, totals) that should be restricted to users with explicit reporting permissions, potentially exposing sensitive business data.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the ProjectViewController::export route (report_project_view_export). Authorization guards are incorrectly placed on the __invoke method rather than at the class level, so the export route inherits no authorization checks while the protected report method does. Any authenticated user with ROLE_USER can call the export endpoint to download the same sensitive dataset returned by the protected report, disclosing customer names, project names, currency, budget type, and aggregate totals. The actual financial figures remain protected in the export template. The fix was released in version 2.64.0, which moves the authorization checks to the class level.
Affected products
- Kimai Kimai before 2.64.0
Timeline
- 2026-08-09: disclosed
- 2026-08-26: patched: Fix released in version 2.64.0