Executive brief
Kimai is a time tracking and project management application. A flaw in the team update API endpoint allows authenticated users with team-editing permissions to remove all team members and leaders by submitting invalid data. While the system rejects the invalid request, it has already deleted the memberships from the database, bypassing safeguards that normally prevent teamlead removal and potentially leaving teams with no members at all.
Technical details
The vulnerability is a business logic flaw in the PATCH /api/teams/{id} API endpoint. The endpoint deletes all existing team members from the database before validating the replacement member list; if validation fails, the deletion is not rolled back. An authenticated user with team-edit permissions can exploit this by sending a malformed members payload, causing Kimai to validate the request, reject it, but keep the deleted membership rows. This bypasses the dedicated DELETE /api/teams/{id}/members/{userId} endpoint, which explicitly prevents teamlead removal. The attack requires authentication and team-edit permissions. The vulnerability affects Kimai versions before 2.63.0; patched versions validate the new member list before making database changes.
Affected products
- Kimai Kimai before 2.63.0
Timeline
- 2026-08-05: disclosed
- 2026-08-26: advisory
- 2026-08-26: patched: Fixed in version 2.63.0