CVE-2026-80195: Kimai before 2.63.0 Team Membership Removal via API
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead (or other user) with permission to edit a team can submit a malformed members payload; although Kimai returns a validation error, the existing membership rows have already been deleted. This bypasses the dedicated member-removal endpoint's protection against removing teamleaders and can leave a team with no members or teamleaders, disrupting team-based access control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kimaito a version that resolves this vulnerability.Fixed in 2.63.0 - Compensating control
As a compensating measure, avoid using the team update API endpoint PATCH /api/teams/{id} to manage team membership until Kimai 2.63.0 is applied; use the dedicated member-removal endpoint instead to prevent removing teamleaders.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who is a teamlead or otherwise has permission to edit a team can trigger it through the team update API endpoint. The attacker does not need to use the dedicated member-removal endpoint.
What conditions are required to trigger the membership removal?
The attacker submits a malformed members payload to PATCH /api/teams/{id}. Kimai deletes the existing membership rows before it validates the replacement list, even though the request ultimately returns a validation error.
What is the practical impact on an affected team?
A successful request can remove all existing team members, including teamleaders, leaving the team without members or teamleaders. This can disrupt team-based access control.
How can I determine whether an attempted exploitation occurred?
Review team membership changes and API activity for PATCH requests to /api/teams/{id} that returned validation errors. Affected teams may have no remaining members or teamleaders despite the failed update response.