6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28685

CVE-2026-28685: Kimai: API invoice endpoint missing customer-level access control (IDOR)

Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28685

CVE-2026-28685:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kimai/kimai	composer	<= 2.50.0	2.51.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the Kimai API, specifically within the InvoiceController. The analysis of the patch commit a0601c8cb28fed1cca19051a8272425069ab758f reveals that two functions were missing critical authorization checks.

App\API\InvoiceController::getAction: This function is responsible for fetching a single invoice via GET /api/invoices/{id}. The vulnerability description correctly identifies that this function only performed a role-based check (view_invoice) and completely omitted a check to ensure the user had access to the specific customer associated with the invoice. The patch rectifies this by adding an #[IsGranted] attribute that enforces this customer-level access check, preventing users from accessing invoices outside of their authorized scope.
App\API\InvoiceController::cgetAction: This function handles the listing and filtering of invoices via GET /api/invoices. The patch shows a new access check being added when filtering by customer. Before the fix, a user could enumerate invoices belonging to customers they shouldn't have access to by passing the customer ID as a filter parameter. The added isGranted('access', $customer) check ensures that the user can only filter for invoices of customers they are permitted to see.

Both functions were vulnerable because they failed to properly enforce data isolation between different teams/customers, allowing any user with the ROLE_TEAMLEAD role to read sensitive financial data across the entire system.

Vulnerable functions

App\API\InvoiceController::getAction

src/API/InvoiceController.php

This function, which handles GET requests for a single invoice, was vulnerable to an Insecure Direct Object Reference (IDOR). It only checked for the 'view_invoice' permission but failed to verify if the user had access to the customer associated with the invoice. This allowed any user with the 'ROLE_TEAMLEAD' permission to access any invoice in the system by its ID, regardless of team assignments.

App\API\InvoiceController::cgetAction

src/API/InvoiceController.php

This function, which handles fetching a list of invoices, was vulnerable because it did not check for access permissions when filtering invoices by customer. A user could specify a customer ID in the request and retrieve invoices for that customer, even if they were not authorized to view them. The patch added an explicit access check for each customer specified in the filter.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.