{"id":"CVE-2026-49992","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-49992","summary":" Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes","details":"### Summary\n\nKimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team.\n\nAs a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut.\n\n### Details\n\nThe issue affects at least the following routes:\n\n- `GET /en/admin/project/{id}/create_team`\n- `GET /en/admin/customer/{id}/create_team`\n- `GET /en/admin/activity/{id}/create_team`\n\nEach of these routes is a `GET` endpoint, yet each performs persistent writes that alter authorization structure:\n\n- create or reuse a `Team`\n- add the current user as `teamlead`\n- bind the target `Project`, `Customer`, or `Activity` to that team\n\n*A PoC was provided, but removed for security reasons.*\n\n### Impact\n\nThis vulnerability allows an attacker to remotely alter permission topology while the victim is logged in. A successful exploit can create or reuse a team, assign the victim as its teamlead, and bind a project, customer, or activity to that team without intentional user action.\n\nThe pre-requisite is, that the logged-in user already has access to manage permissions of the object in question.\n\nBecause these routes modify authorization structure rather than a simple personal preference, the business impact can extend into visibility rules, assignment scope, team-based access control, reporting, and later privilege-expansion chains. This makes the issue materially more serious than a low-value cosmetic CSRF.\n\n## Solution\n\n- The routes have been moved to API `POST` endpoints\n\nSee https://www.kimai.org/en/security/ghsa-pgcc-vfmc-7cw5","published":"2026-07-13T23:55:01Z","modified":"2026-07-14T00:00:09.448782723Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Packagist","name":"kimai/kimai","fixedVersion":"2.58.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/kimai/kimai/security/advisories/GHSA-pgcc-vfmc-7cw5"},{"type":"PACKAGE","url":"https://github.com/kimai/kimai"},{"type":"WEB","url":"https://www.kimai.org/en/security/ghsa-pgcc-vfmc-7cw5"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-14T00:00:09.448782723Z"}}