Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
The advisory, in context
Summary
Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target object to that team.
As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut.
Details
The issue affects at least the following routes:
GET /en/admin/project/{id}/create_teamGET /en/admin/customer/{id}/create_teamGET /en/admin/activity/{id}/create_team
Each of these routes is a GET endpoint, yet each performs persistent writes that alter authorization structure:
- create or reuse a
Team - add the current user as
teamlead - bind the target
Project,Customer, orActivityto that team
A PoC was provided, but removed for security reasons.
Impact
This vulnerability allows an attacker to remotely alter permission topology while the victim is logged in. A successful exploit can create or reuse a team, assign the victim as its teamlead, and bind a project, customer, or activity to that team without intentional user action.
The pre-requisite is, that the logged-in user already has access to manage permissions of the object in question.
Because these routes modify authorization structure rather than a simple personal preference, the business impact can extend into visibility rules, assignment scope, team-based access control, reporting, and later privilege-expansion chains. This makes the issue materially more serious than a low-value cosmetic CSRF.
Solution
- The routes have been moved to API
POSTendpoints
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 2.58.0
Fixed in 2.58.0
203 explicitly affected versions
0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.6.1, 0.7, 0.8, 0.8.1, 0.9, 1.0, 1.0.1, 1.1, 1.10, 1.10.1, 1.10.2, 1.11, 1.11.1, 1.12, 1.13, 1.14, 1.14.1, 1.14.2, 1.14.3, 1.15, 1.15.1, 1.15.2, 1.15.3, 1.15.4, 1.15.5, 1.15.6, 1.16, 1.16.1, 1.16.10, 1.16.2, 1.16.3, 1.16.4, 1.16.5, 1.16.6, 1.16.7, 1.16.8, 1.16.9, 1.17, 1.17.1, 1.18, 1.18.1, 1.18.2, 1.19, 1.19.1, 1.19.2, 1.19.3, 1.19.4, 1.19.5, 1.19.6, 1.19.7, 1.2, 1.20, 1.20.1, 1.20.2, 1.20.3, 1.20.4, 1.21.0, 1.22.0, 1.22.1, 1.23.0, 1.23.1, 1.24.0, 1.25.0, 1.26.0, 1.27.0, 1.28.0, 1.28.1, 1.29.0, 1.29.1, 1.3, 1.30.0, 1.30.1, 1.30.10, 1.30.11, 1.30.2, 1.30.3, 1.30.4, 1.30.5, 1.30.6, 1.30.7, 1.30.8, 1.30.9, 1.4, 1.4.1, 1.4.2, 1.5, 1.6, 1.6.1, 1.6.2, 1.7, 1.8, 1.9, 2.0.0, 2.0.0-alpha, 2.0.0-beta, 2.0.0-beta-2, 2.0.0-beta-3, 2.0.0-rc-1, 2.0.1, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.0.19, 2.0.2, 2.0.20, 2.0.21, 2.0.22, 2.0.23, 2.0.24, 2.0.25, 2.0.26, 2.0.27, 2.0.28, 2.0.29, 2.0.3, 2.0.30, 2.0.31, 2.0.32, 2.0.33, 2.0.34, 2.0.35, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.1.0, 2.10.0, 2.11.0, 2.12.0, 2.13.0, 2.14.0, 2.15.0, 2.16.0, 2.16.1, 2.17.0, 2.18.0, 2.19.0, 2.19.1, 2.2.0, 2.2.1, 2.20.0, 2.20.1, 2.21.0, 2.22.0, 2.23.0, 2.24.0, 2.25.0, 2.26.0, 2.27.0, 2.28.0, 2.29.0, 2.3.0, 2.30.0, 2.31.0, 2.32.0, 2.33.0, 2.34.0, 2.35.0, 2.35.1, 2.36.0, 2.36.1, 2.37.0, 2.38.0, 2.39.0, 2.4.0, 2.4.1, 2.40.0, 2.41.0, 2.42.0, 2.43.0, 2.44.0, 2.45.0, 2.46.0, 2.47.0, 2.48.0, 2.49.0, 2.5.0, 2.50.0, 2.51.0, 2.52.0, 2.53.0, 2.54.0, 2.55.0, 2.56.0, 2.57.0, 2.6.0, 2.7.0, 2.8.0, 2.9.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.58.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1",
"0.2",
"0.3",
"0.4",
"0.5",
"0.6",
"0.6.1",
"0.7",
"0.8",
"0.8.1",
"0.9",
"1.0",
"1.0.1",
"1.1",
"1.10",
"1.10.1",
"1.10.2",
"1.11",
"1.11.1",
"1.12",
"1.13",
"1.14",
"1.14.1",
"1.14.2",
"1.14.3",
"1.15",
"1.15.1",
"1.15.2",
"1.15.3",
"1.15.4",
"1.15.5",
"1.15.6",
"1.16",
"1.16.1",
"1.16.10",
"1.16.2",
"1.16.3",
"1.16.4",
"1.16.5",
"1.16.6",
"1.16.7",
"1.16.8",
"1.16.9",
"1.17",
"1.17.1",
"1.18",
"1.18.1",
"1.18.2",
"1.19",
"1.19.1",
"1.19.2",
"1.19.3",
"1.19.4",
"1.19.5",
"1.19.6",
"1.19.7",
"1.2",
"1.20",
"1.20.1",
"1.20.2",
"1.20.3",
"1.20.4",
"1.21.0",
"1.22.0",
"1.22.1",
"1.23.0",
"1.23.1",
"1.24.0",
"1.25.0",
"1.26.0",
"1.27.0",
"1.28.0",
"1.28.1",
"1.29.0",
"1.29.1",
"1.3",
"1.30.0",
"1.30.1",
"1.30.10",
"1.30.11",
"1.30.2",
"1.30.3",
"1.30.4",
"1.30.5",
"1.30.6",
"1.30.7",
"1.30.8",
"1.30.9",
"1.4",
"1.4.1",
"1.4.2",
"1.5",
"1.6",
"1.6.1",
"1.6.2",
"1.7",
"1.8",
"1.9",
"2.0.0",
"2.0.0-alpha",
"2.0.0-beta",
"2.0.0-beta-2",
"2.0.0-beta-3",
"2.0.0-rc-1",
"2.0.1",
"2.0.10",
"2.0.11",
"2.0.12",
"2.0.13",
"2.0.14",
"2.0.15",
"2.0.16",
"2.0.17",
"2.0.18",
"2.0.19",
"2.0.2",
"2.0.20",
"2.0.21",
"2.0.22",
"2.0.23",
"2.0.24",
"2.0.25",
"2.0.26",
"2.0.27",
"2.0.28",
"2.0.29",
"2.0.3",
"2.0.30",
"2.0.31",
"2.0.32",
"2.0.33",
"2.0.34",
"2.0.35",
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"2.0.8",
"2.0.9",
"2.1.0",
"2.10.0",
"2.11.0",
"2.12.0",
"2.13.0",
"2.14.0",
"2.15.0",
"2.16.0",
"2.16.1",
"2.17.0",
"2.18.0",
"2.19.0",
"2.19.1",
"2.2.0",
"2.2.1",
"2.20.0",
"2.20.1",
"2.21.0",
"2.22.0",
"2.23.0",
"2.24.0",
"2.25.0",
"2.26.0",
"2.27.0",
"2.28.0",
"2.29.0",
"2.3.0",
"2.30.0",
"2.31.0",
"2.32.0",
"2.33.0",
"2.34.0",
"2.35.0",
"2.35.1",
"2.36.0",
"2.36.1",
"2.37.0",
"2.38.0",
"2.39.0",
"2.4.0",
"2.4.1",
"2.40.0",
"2.41.0",
"2.42.0",
"2.43.0",
"2.44.0",
"2.45.0",
"2.46.0",
"2.47.0",
"2.48.0",
"2.49.0",
"2.5.0",
"2.50.0",
"2.51.0",
"2.52.0",
"2.53.0",
"2.54.0",
"2.55.0",
"2.56.0",
"2.57.0",
"2.6.0",
"2.7.0",
"2.8.0",
"2.9.0"
]
}