CVE-2026-41498

LOW SEVERITY

CVSS Score & Metrics

Base Score

3.3 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N                                    

Vulnerability Description

Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage. This issue has been patched in version 2.54.0.

Vulnerability Details

Published Date

April 24, 2026

Last Modified

May 12, 2026

CWE ID

CWE-862

Source

GitHub

Vendor

composer

Product

kimai/kimai

External References

https://github.com/kimai/kimai/security/advisories/GHSA-jv9x-w4gm-hwcm
https://github.com/advisories/GHSA-jv9x-w4gm-hwcm

CVE-2026-41498

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment