https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 16:50:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-309258 EUVD-2026-309258 https://cve.radiocsirt.org/vuln/euvd-2026-309258 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41498 <p>Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted(&#39;edit_team&#39;)] instead of #[IsGranted(&#39;edit&#39;, &#39;team&#39;)], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage. This issue has been patched in version 2.54.0.</p> <p>Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted(&#39;edit_team&#39;)] instead of #[IsGranted(&#39;edit&#39;, &#39;team&#39;)], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage. This issue has been patched in version 2.54.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41498 https://cve.radiocsirt.org/vuln/ghsa-jv9x-w4gm-hwcm <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p>### Summary The Team API endpoints use #[IsGranted(&#39;edit_team&#39;)] instead of #[IsGranted(&#39;edit&#39;, &#39;team&#39;)], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage.</p> <p>### Details All 8 team association endpoints in src/API/TeamController.php (lines 177, 201, 229, 252, 275, 298, 321, 339) use #[IsGranted(&#39;edit_team&#39;)] with a single argument. The web controller at src/Controller/TeamController.php:118 correctly uses #[IsGranted(&#39;edit&#39;, &#39;team&#39;)] with two arguments, passing the $team parameter as the subject. When edit_team is passed as the attribute, TeamVoter::supportsAttribute() returns false because it only recognizes view, edit, and delete. The voter abstains entirely. Only RolePermissionVoter fires, which checks the role-level permission without any entity-level ownership validation.</p> <p>### PoC #### Authenticate as a user with edit_team permission who is NOT a member of Team 1 ``` curl -X POST https://TARGET/api/teams/1/members/2 \ -H &#34;Authorization: Bearer &lt;API_TOKEN&gt;&#34; \ -H &#34;Content-Type: application/json&#34; ```</p> <p>#### Expected: 403 Forbidden (user is not ROLE_ADMIN/ROLE_SUPER_ADMIN, or member of Team 1) #### Actual (pre-2.54.0): 200 OK, user added to Team 1</p> <p>### Impact In default configuration, only ROLE_ADMIN and ROLE_SUPER_ADMIN have edit_team, and both roles already have irrevocable view_all_data access,…</p> <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p>### Summary The Team API endpoints use #[IsGranted(&#39;edit_team&#39;)] instead of #[IsGranted(&#39;edit&#39;, &#39;team&#39;)], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage.</p> <p>### Details All 8 team association endpoints in src/API/TeamController.php (lines 177, 201, 229, 252, 275, 298, 321, 339) use #[IsGranted(&#39;edit_team&#39;)] with a single argument. The web controller at src/Controller/TeamController.php:118 correctly uses #[IsGranted(&#39;edit&#39;, &#39;team&#39;)] with two arguments, passing the $team parameter as the subject. When edit_team is passed as the attribute, TeamVoter::supportsAttribute() returns false because it only recognizes view, edit, and delete. The voter abstains entirely. Only RolePermissionVoter fires, which checks the role-level permission without any entity-level ownership validation.</p> <p>### PoC #### Authenticate as a user with edit_team permission who is NOT a member of Team 1 ``` curl -X POST https://TARGET/api/teams/1/members/2 \ -H &#34;Authorization: Bearer &lt;API_TOKEN&gt;&#34; \ -H &#34;Content-Type: application/json&#34; ```</p> <p>#### Expected: 403 Forbidden (user is not ROLE_ADMIN/ROLE_SUPER_ADMIN, or member of Team 1) #### Actual (pre-2.54.0): 200 OK, user added to Team 1</p> <p>### Impact In default configuration, only ROLE_ADMIN and ROLE_SUPER_ADMIN have edit_team, and both roles already have irrevocable view_all_data access,…</p> https://cve.radiocsirt.org/vuln/ghsa-jv9x-w4gm-hwcm