Kimai versions prior to 2.63.0 contain a business‑logic flaw in the PATCH /api/teams/{id} endpoint that removes all current team members before validating the payload. An authenticated user with permission to edit a team can submit an invalid members list; although the response returns a validation error, the initial removal has already been committed. The effect is a denial of service to team‑based access control because the team may end up with no members or leaders, undermining intra‑application authorization.

Affected products include Kimai software version prior to 2.63.0. The vulnerability is documented under the 'kimai:kimai' product family and applies to all installations using the exposed API endpoint.

The CVSS score stands at 8.7, reflecting a high‑severity vulnerability. EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who has edit rights on a team, making it an internal attack vector. Once the user submits a malformed payload, the API performs the removal before rejecting the request, which effectively bypasses the dedicated removal protection and can leave the system in a broken state. The impact is significant for any organization relying on Kimai to enforce team isolation.