Kimai’s API endpoint for retrieving invoices performs a role-based permission check for view_invoice but does not confirm that the requester’s assigned customer matches the invoice’s customer. Consequently, a user granted the ROLE_TEAMLEAD role—allowed to view invoices in general—can retrieve any invoice in the system, even those belonging to customers under different teams. This results in confidentiality leakage of sensitive billing information. The weakness corresponds to CWE‑285, indicating improper authorization checks.

The affected product is Kimai by Kimai. All installations of Kimai released before version 2.51.0 are vulnerable, regardless of the specific minor patch level. Customers using the API endpoint directly (GET /api/invoices/{id}) on these versions should consider themselves exposed.

The CVSS score is 6.5, denoting moderate severity. EPSS is < 1%, suggesting a low probability of exploitation at the time of assessment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a compromised or privileged user in the system who authenticates and makes direct API requests. No additional network or privilege escalation steps are required; the flaw can be exploited over any web connection that permits authenticated API calls.