No access to your tenant or devices. Every item links to its source. What this means
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team. As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut. Version 2.58.0 patches the issue.
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "kimai",
"product": "kimai",
"versions": [
{
"version": "< 2.58.0",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON