CyberRota Analysis
AI-GeneratedVersions of Kimai from 2.61.0 to before 2.63.0 are vulnerable due to insufficient permission checks in the PATCH /api/users/{id}/preferences endpoint, allowing low-privilege users to modify admin-only work-contract preferences. This could lead to unauthorized changes to sensitive employment contract data, potentially compromising the integrity of user contracts. Organizations using affected versions should prioritize upgrading to 2.63.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.