The vulnerability arises from the ProjectViewController export route in Kimai, where authorization checks were mistakenly attached to the sibling __invoke method rather than the class itself. As a result, any authenticated user, even those with only the ROLE_USER role lacking the project_reporting permission, may access the report_project_view_export endpoint. This allows the download of a project overview export that contains customer names, project names, currency, budget type, and aggregate totals for all customers. While actual financial figures remain confined to the export template, the exposed metadata can aid malicious actors in reconnaissance and planning.

All releases of Kimai prior to version 2.64.0 are affected. The issue exists in the project view export functionality across these versions. No specific sub‑product or patched version is listed in the reporting sources.

The CVSS score of 8.7 classifies the flaw as high severity. Exploitation requires only valid user credentials and does not demand any privileged or administrative access. Since an authenticated attacker can freely retrieve the export, the risk of information leakage is significant. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no current high‑profile exploitation. Nevertheless, the high impact on confidentiality warrants immediate remediation.