CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated users with project permission-management privileges in Kimai to exploit the team creation endpoints, enabling them to gain unauthorized team-lead rights over existing teams by reusing team names. This could lead to unauthorized access and management of sensitive project resources. Organizations using Kimai versions prior to 2.65.0 should prioritize patching to mitigate the risk of privilege escalation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0.