CyberRota Analysis
AI-GeneratedThe team update API endpoint in Kimai versions prior to 2.63.0 is vulnerable to a business logic flaw that allows authenticated users with edit permissions to inadvertently remove all existing team members without proper validation of the replacement list. This can lead to a complete loss of team structure, potentially leaving teams without any members or leaders, which disrupts access control and operational functionality. Organizations using Kimai should prioritize patching this vulnerability to maintain team integrity and prevent unauthorized access disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead (or other user) with permission to edit a team can submit a malformed members payload; although Kimai returns a validation error, the existing membership rows have already been deleted. This bypasses the dedicated member-removal endpoint's protection against removing teamleaders and can leave a team with no members or teamleaders, disrupting team-based access control.