CVE-2026-41498: Kimai

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit', 'team')], causing Symfony TeamVoter to abstain from voting. This removes entity-level ownership checks on team operations, allowing any user with the edit_team permission to modify any team, not just teams they are authorized to manage. This issue has been patched in version 2.54.0.

Affected products

• Kimai Kimai: before 2.54.0 (fixed in 2.54.0)

Published 2026-05-08. Last modified 2026-06-17.