https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T14:26:31.493981+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-363655 EUVD-2026-363655 2026-10-05T14:26:31.553422+00:00 EUVD-2026-363655 https://cve.radiocsirt.org/vuln/fkie_cve-2026-84804 fkie_cve-2026-84804 2026-10-05T14:26:31.553466+00:00

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.

 https://cve.radiocsirt.org/vuln/ghsa-xcvc-fv83-5g8g GHSA-xcvc-fv83-5g8g 2026-10-05T14:26:31.553502+00:00

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permissions_activity check, bypassing authorization controls.