The vulnerability is an improper authorization flaw in Kimai's team access endpoints, allowing authenticated users who possess team-edit permissions and read-only access to grant additional access to customers, projects, or activities. Attackers can leverage this to elevate their privileges within the application, gaining unauthorized read or edit rights to sensitive data. The weakness is classified as CWE‑732, indicating insufficient permissions for the functions being performed.

The issue affects Kimai installations running any version prior to 2.63.0. Authenticated users with team‑edit or read‑only roles can trigger the exploit regardless of the actual data they are allowed to modify.

The reported CVSS score of 5.3 categorizes the vulnerability as moderate severity. Because the EPSS is unavailable and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation remains uncertain, but the requirement for authentication limits the attack surface to authorized users who may have legitimate reasons to access the system. Exploitability stems from missing permission checks on POST requests to team access endpoints, allowing privilege escalation within the application.