{"id":"CVE-2026-41498","aliases":["GHSA-jv9x-w4gm-hwcm"],"url":"https://o3.security/vulnerability/CVE-2026-41498","summary":"Kimai: Team API Missing Object-Level Authorization","details":"### Summary\nThe Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage.\n\n### Details\nAll 8 team association endpoints in src/API/TeamController.php (lines 177, 201, 229, 252, 275, 298, 321, 339) use #[IsGranted('edit_team')] with a single argument. The web controller at src/Controller/TeamController.php:118 correctly uses #[IsGranted('edit', 'team')] with two arguments, passing the $team parameter as the subject.\nWhen edit_team is passed as the attribute, TeamVoter::supportsAttribute() returns false because it only recognizes view, edit, and delete. The voter abstains entirely. Only RolePermissionVoter fires, which checks the role-level permission without any entity-level ownership validation.\n\n### PoC\n#### Authenticate as a user with edit_team permission who is NOT a member of Team 1\n```\ncurl -X POST https://TARGET/api/teams/1/members/2 \\\n  -H \"Authorization: Bearer <API_TOKEN>\" \\\n  -H \"Content-Type: application/json\"\n```\n\n#### Expected: 403 Forbidden (user is not ROLE_ADMIN/ROLE_SUPER_ADMIN, or member of Team 1)\n#### Actual (pre-2.54.0): 200 OK, user added to Team 1\n\n### Impact\nIn default configuration, only ROLE_ADMIN and ROLE_SUPER_ADMIN have edit_team, and both roles already have irrevocable view_all_data access, making the missing check redundant. The vulnerability becomes exploitable if an administrator grants edit_team to a lower-privilege role (such as ROLE_TEAMLEAD) through the permissions UI. In that scenario, the lower-privilege user could modify any team's membership, customer assignments, project assignments, and activity assignments without being a member or teamlead of that team.","published":"2026-05-08T03:30:32.310Z","modified":"2026-08-12T03:51:24.216158470Z","cvss":{"score":3.3,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"},"epss":{"score":0.00247,"percentile":0.16056,"asOf":"2026-08-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"kimai/kimai","fixedVersion":"2.54.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/kimai/kimai/releases/tag/2.54.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41498.json"},{"type":"ADVISORY","url":"https://github.com/kimai/kimai/security/advisories/GHSA-jv9x-w4gm-hwcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41498"},{"type":"PACKAGE","url":"https://github.com/kimai/kimai"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:24.216158470Z"}}