EUVD-2026-78406
GHSA-rw46-qg69-vg6h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because a valid TEAMLEAD account is required; I:L as only non-critical export template integrity is affected; no confidentiality or availability impact applies.
Primary rating from Vendor (https://github.com/kimai/kimai).
CVSS VectorVendor: https://github.com/kimai/kimai
Lifecycle Timeline
3DescriptionCVE.org
Summary
The ExportController web routes for creating and editing export templates are gated only by the class-level create_export permission, which is granted to ROLE_TEAMLEAD by default. The corresponding API routes and UI button visibility correctly require the stricter create_export_template permission, which is granted only to ROLE_ADMIN and ROLE_SUPER_ADMIN. A TEAMLEAD user can directly access the template create/edit routes to create or modify global export templates that are visible to all users including administrators.
Details
The ExportController applies the class-level annotation #[IsGranted('create_export')].
The createExportTemplate (line 210) and editExportTemplate (line 220) methods have no method-level #[IsGranted('create_export_template')] annotation. The permission hierarchy in config/packages/kimai.yaml:103,115,122-123 grants create_export to ROLE_TEAMLEAD via the EXPORT permission set, but create_export_template only to ROLE_ADMIN and ROLE_SUPER_ADMIN.
The API controller correctly requires create_export_template. The UI template (templates/export/index.html.twig:124) correctly hides the create button behind create_export_template. Only the web controller routes are missing the check.
ExportTemplate entities are global - they have no per-user or per-team scoping (src/Entity/ExportTemplate.php:19-56). Any template created or modified by a TEAMLEAD which is marked as "Available for all users" is visible to and usable by every user in the instance.
*A PoC was provided, but removed for security reasons.*
Impact
Any user with ROLE_TEAMLEAD can create and modify global export templates intended to be managed only by administrators. The templates control the structure and content of exported data (columns, renderer, format). While the impact is limited to data integrity manipulation of a non-security-critical resource (no RCE, no credential exposure), it violates the intended permission boundary and allows a lower-privileged user to influence the data output format used by all users including administrators.
Solution
The permission check #[IsGranted('create_export_template')] was added to the ExportController covering the methods createExportTemplate() and editExportTemplate.
See https://www.kimai.org/en/security/ghsa-rw46-qg69-vg6h for more details.
AnalysisAI
Privilege escalation in Kimai time-tracking software (<=2.57.0) allows authenticated TEAMLEAD users to create and modify global export templates that are intended to be administrator-only resources. The web controller routes createExportTemplate and editExportTemplate in ExportController inherit only the class-level create_export permission - granted to ROLE_TEAMLEAD - while the API endpoints and UI correctly enforce the stricter create_export_template permission restricted to ROLE_ADMIN and ROLE_SUPER_ADMIN. Because ExportTemplate entities have no per-user or per-team scoping, a TEAMLEAD can silently alter organization-wide export configurations affecting all users including administrators. No public exploit is confirmed at time of analysis, though a private PoC was submitted to the vendor and subsequently removed.
Technical ContextAI
Kimai is a PHP-based time-tracking web application built on the Symfony framework, which uses attribute-based authorization via #[IsGranted()] annotations on controllers. The affected package is composer/kimai/kimai. The root cause (CWE-862: Missing Authorization) is that the ExportController class applies #[IsGranted('create_export')] globally, but the two route methods createExportTemplate (line 210) and editExportTemplate (line 220) lack method-level #[IsGranted('create_export_template')] overrides. The permission hierarchy in config/packages/kimai.yaml:103,115,122-123 grants create_export to ROLE_TEAMLEAD via the EXPORT permission set, while create_export_template is scoped exclusively to ROLE_ADMIN and ROLE_SUPER_ADMIN. The ExportTemplate entity (src/Entity/ExportTemplate.php:19-56) carries no per-user or per-team ownership fields, meaning any template marked 'Available for all users' is globally visible and usable across the entire Kimai instance. The API controller and the Twig UI template (templates/export/index.html.twig:124) both correctly enforce the higher permission - only the web controller routes are deficient.
RemediationAI
Upgrade Kimai to version 2.58.0 or later, which adds the #[IsGranted('create_export_template')] annotation to both createExportTemplate() and editExportTemplate() in ExportController, closing the authorization gap at the method level. Full vendor advisory details are available at https://www.kimai.org/en/security/ghsa-rw46-qg69-vg6h and https://github.com/kimai/kimai/security/advisories/GHSA-rw46-qg69-vg6h. If an immediate upgrade is not feasible, a targeted compensating control is to block the affected web routes (typically /export/template/create and /export/template/{id}/edit) at the reverse proxy or web server for all non-admin sessions; this prevents exploitation but breaks template management entirely for TEAMLEADs until patching, which is acceptable since they should not have that access. A second option is to audit current TEAMLEAD role assignments and remove any users who should not influence organization-wide data exports, reducing blast radius without a proxy change.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today