https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T18:04:13.224335+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-41498 CVE-2026-41498 — Kimai: Team API Missing Object-Level Authorization 2026-10-18T18:04:13.226097+00:00

Affected: kimai

Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage. This issue has been patched in version 2.54.0.