CVE-2026-41498CWE-862

Kimai: Team API Missing Object-Level Authorization

Low · published May 8, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage. This issue has been patched in version 2.54.0.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-08T03:30Z
EPSS history
Timeline
  • 08 MAY 03:30Z
    Kimai: Team API Missing Object-Level Authorization
    cvelistv5