Beveiligingsadvies

CVE-2026-41498

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-05-08 03:30:32

Laatst bijgewerkt 2026-05-08 21:28:32

Toegewezen door GitHub_M

CVSS-score 3.3

Status PUBLISHED

Beschrijving

Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage. This issue has been patched in version 2.54.0.

← Alle CVE's bekijken Bekijk op cve.org ↗