Technical impact
The vulnerability originates from an incorrect security annotation on Kimai’s Team API endpoints. The endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit','team')], which causes the Symfony TeamVoter to abstain and skip the entity‑level ownership checks. As a result, any authenticated user who has the edit_team permission can alter any team record, regardless of ownership. This flaw falls under CWE‑862 (Missing Authorization) and permits unauthorized data tampering.
Affected Systems
All installations of Kimai older than version 2.54.0 that expose the Team API are affected. The open‑source time‑tracking application, Kimai, is provided by the kimai organization. The flaw does not depend on server configuration or additional plugins; any instance exposing the API is vulnerable.
Risk and Exploitability
The CVSS score of 3.3 classifies the issue as low severity, and no EPSS metric is available, indicating an uncertain exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers need only authenticated access with the edit_team role; no additional privileges or remote code execution are required. They can modify team properties, potentially creating confusion or misallocating time entries. Because the scope is limited to team objects, the impact is contained, but any tampering can affect reporting and billing accuracy.
Github GHSA