Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

• <= 2.57.0

### Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team. As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut. ### Details The issue affects at least the following routes: - `GET /en/admin/project/{id}/create_team` - `GET /en/admin/customer/{id}/create_team` - `GET /en/admin/activity/{id}/create_team` Each of these routes is a `GET` endpoint, yet each performs persistent writes that alter authorization structure: - create or reuse a `Team` - add the current user as `teamlead` - bind the target `Project`, `Customer`, or `Activity` to that team *A PoC was provided, but removed for security reasons.* ### Impact This vulnerability allows an attacker to remotely alter permission to

GitHub Advisory Database

• ECOSYSTEM: introduced 0; fixed 2.58.0

### Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team. As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut. ### Details The issue affects at least the following routes: - `GET /en/admin/project/{id}/create_team` - `GET /en/admin/customer/{id}/create_team` - `GET /en/admin/activity/{id}/create_team` Each of these routes is a `GET` endpoint, yet each performs persistent writes that alter authorization structure: - create or reuse a `Team` - add the current user as `teamlead` - bind the target `Project`, `Customer`, or `Activity` to that team *A PoC was provided, but removed for security reasons.* ### Impact This vulnerability allows an attacker to remotely alter permission to

GitHub Advisory Database via OSV