https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:54:50 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-52828 <p>Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit only the class-level create_export permission, which ROLE_TEAMLEAD receives by default, and omit the create_export_template permission required by the API routes and user interface. A teamlead can directly access the export template creation and editing web routes to create or modify global ExportTemplate records marked available to all users, altering export columns, renderer, format, and output used by other users and administrators. This issue is fixed in version 2.58.0.</p> <p>Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit only the class-level create_export permission, which ROLE_TEAMLEAD receives by default, and omit the create_export_template permission required by the API routes and user interface. A teamlead can directly access the export template creation and editing web routes to create or modify global ExportTemplate records marked available to all users, altering export columns, renderer, format, and output used by other users and administrators. This issue is fixed in version 2.58.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-52828 https://vulnerability.circl.lu/vuln/ghsa-rw46-qg69-vg6h <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p>### Summary</p> <p>The `ExportController` web routes for creating and editing export templates are gated only by the class-level `create_export` permission, which is granted to `ROLE_TEAMLEAD` by default. The corresponding API routes and UI button visibility correctly require the stricter `create_export_template` permission, which is granted only to `ROLE_ADMIN` and `ROLE_SUPER_ADMIN`. A TEAMLEAD user can directly access the template create/edit routes to create or modify global export templates that are visible to all users including administrators.</p> <p>### Details</p> <p>The `ExportController` applies the class-level annotation `#[IsGranted(&#39;create_export&#39;)]`.</p> <p>The `createExportTemplate` (line 210) and `editExportTemplate` (line 220) methods have no method-level `#[IsGranted(&#39;create_export_template&#39;)]` annotation. The permission hierarchy in `config/packages/kimai.yaml:103,115,122-123` grants `create_export` to `ROLE_TEAMLEAD` via the `EXPORT` permission set, but `create_export_template` only to `ROLE_ADMIN` and `ROLE_SUPER_ADMIN`.</p> <p>The API controller correctly requires `create_export_template`. The UI template (`templates/export/index.html.twig:124`) correctly hides the create button behind `create_export_template`. Only the web controller routes are missing the check.</p> <p>`ExportTemplate` entities are global — they have no per-user or per-team scoping (`src/Entity/ExportTemplate.php:19-56`). Any template created or modified by a TEAMLEAD which is marked as &#34;Available for all users&#34; is vis…</p> <p><strong>Affected:</strong> Packagist: kimai/kimai</p> <p>### Summary</p> <p>The `ExportController` web routes for creating and editing export templates are gated only by the class-level `create_export` permission, which is granted to `ROLE_TEAMLEAD` by default. The corresponding API routes and UI button visibility correctly require the stricter `create_export_template` permission, which is granted only to `ROLE_ADMIN` and `ROLE_SUPER_ADMIN`. A TEAMLEAD user can directly access the template create/edit routes to create or modify global export templates that are visible to all users including administrators.</p> <p>### Details</p> <p>The `ExportController` applies the class-level annotation `#[IsGranted(&#39;create_export&#39;)]`.</p> <p>The `createExportTemplate` (line 210) and `editExportTemplate` (line 220) methods have no method-level `#[IsGranted(&#39;create_export_template&#39;)]` annotation. The permission hierarchy in `config/packages/kimai.yaml:103,115,122-123` grants `create_export` to `ROLE_TEAMLEAD` via the `EXPORT` permission set, but `create_export_template` only to `ROLE_ADMIN` and `ROLE_SUPER_ADMIN`.</p> <p>The API controller correctly requires `create_export_template`. The UI template (`templates/export/index.html.twig:124`) correctly hides the create button behind `create_export_template`. Only the web controller routes are missing the check.</p> <p>`ExportTemplate` entities are global — they have no per-user or per-team scoping (`src/Entity/ExportTemplate.php:19-56`). Any template created or modified by a TEAMLEAD which is marked as &#34;Available for all users&#34; is vis…</p> https://vulnerability.circl.lu/vuln/ghsa-rw46-qg69-vg6h