https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 15:50:52 +0000 https://cve.radiocsirt.org/vuln/cve-2026-28685 <p><strong>Affected:</strong> kimai</p> <p>Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, &#34;GET /api/invoices/{id}&#34; only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice&#39;s customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.</p> <p><strong>Affected:</strong> kimai</p> <p>Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, &#34;GET /api/invoices/{id}&#34; only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice&#39;s customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-28685