CyberRota Analysis
AI-GeneratedKimai versions prior to 2.64.0 have a missing authorization vulnerability in the ProjectViewController's export route, allowing any authenticated user, even those with minimal permissions, to access sensitive project overview data. This exposure can lead to unauthorized disclosure of customer names, project details, and financial summaries, although specific financial figures remain protected. Organizations using Kimai should prioritize patching this vulnerability to prevent potential data leaks and ensure proper access controls are enforced.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are attached to the sibling __invoke method rather than at the class level, so the export route inherits no authorization checks. Any authenticated user, including a plain ROLE_USER without the project_reporting permission, can download the project overview export - which returns the same dataset as the protected report - disclosing customer names, project names, currency, budget type, and aggregate totals across all customers. Actual financial figures remain protected in the export template.