Kimai before version 2.65.0 contains a business‑logic flaw that allows an authenticated user with project permission‑management privileges to create a customer, project, or activity whose name matches an existing team. The POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team endpoints will reuse the existing team with that name and add the calling user as team lead without checking that the user is authorized to manage that team. The result is that the attacker gains unauthorized administrative control over the existing team, allowing manipulation of all associated data. The flaw is an improper privilege‑management vulnerability classified as CWE‑266.

All installations of Kimai (kimai/kimai) before version 2.65.0 are vulnerable. The vulnerability is present in the default team creation endpoints for customers, projects, and activities.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is approximately 0.25%, suggesting a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker first authenticate to the system and possess project permission‑management privileges; thus the attack vector is likely internal or requires prior compromise of an authorized account.