{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-28685",
        "tracking": {
            "current_release_date": "2026-03-20T09:36:39.002162Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-28685",
            "initial_release_date": "2026-03-04T21:51:02.947731Z",
            "revision_history": [
                {
                    "date": "2026-03-04T21:51:02.947731Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)."
                },
                {
                    "date": "2026-03-04T21:51:07.196106Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-03-05T00:32:02.109464Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (191).| Product Identifiers created (196).| Products created (6).| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-03-05T00:32:20.223908Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-06T05:25:38.043488Z",
                    "number": "5",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-03-06T05:25:41.194106Z",
                    "number": "6",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-06T05:39:00.141287Z",
                    "number": "7",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-03-06T05:39:04.624870Z",
                    "number": "8",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-06T14:52:45.438629Z",
                    "number": "9",
                    "summary": "Source created.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-03-06T14:52:47.402094Z",
                    "number": "10",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-06T16:00:49.638107Z",
                    "number": "11",
                    "summary": "References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-06T18:30:28.598585Z",
                    "number": "12",
                    "summary": "References created (1).| CWES updated (1)."
                },
                {
                    "date": "2026-03-09T20:39:05.573555Z",
                    "number": "13",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-03-09T20:39:19.334558Z",
                    "number": "14",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-10T21:25:44.459318Z",
                    "number": "15",
                    "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)."
                },
                {
                    "date": "2026-03-10T21:25:47.050669Z",
                    "number": "16",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-20T09:36:34.470805Z",
                    "number": "17",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-03-20T09:36:37.912574Z",
                    "number": "18",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "18"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.1",
                                "product": {
                                    "name": "vers:unknown/0.1",
                                    "product_id": "CSAFPID-998647",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.2",
                                "product": {
                                    "name": "vers:unknown/0.2",
                                    "product_id": "CSAFPID-998608",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.3",
                                "product": {
                                    "name": "vers:unknown/0.3",
                                    "product_id": "CSAFPID-998626",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.4",
                                "product": {
                                    "name": "vers:unknown/0.4",
                                    "product_id": "CSAFPID-998640",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.5",
                                "product": {
                                    "name": "vers:unknown/0.5",
                                    "product_id": "CSAFPID-998653",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.6",
                                "product": {
                                    "name": "vers:unknown/0.6",
                                    "product_id": "CSAFPID-998601",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.6.1",
                                "product": {
                                    "name": "vers:unknown/0.6.1",
                                    "product_id": "CSAFPID-998609",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.6.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.7",
                                "product": {
                                    "name": "vers:unknown/0.7",
                                    "product_id": "CSAFPID-998612",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.7"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.8",
                                "product": {
                                    "name": "vers:unknown/0.8",
                                    "product_id": "CSAFPID-998629",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.8"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.8.1",
                                "product": {
                                    "name": "vers:unknown/0.8.1",
                                    "product_id": "CSAFPID-998592",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.8.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/0.9",
                                "product": {
                                    "name": "vers:unknown/0.9",
                                    "product_id": "CSAFPID-998646",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@0.9"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.0",
                                "product": {
                                    "name": "vers:unknown/1.0",
                                    "product_id": "CSAFPID-998639",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.0.1",
                                "product": {
                                    "name": "vers:unknown/1.0.1",
                                    "product_id": "CSAFPID-998604",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.0.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.1",
                                "product": {
                                    "name": "vers:unknown/1.1",
                                    "product_id": "CSAFPID-998614",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.10",
                                "product": {
                                    "name": "vers:unknown/1.10",
                                    "product_id": "CSAFPID-998591",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.10"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.10.1",
                                "product": {
                                    "name": "vers:unknown/1.10.1",
                                    "product_id": "CSAFPID-998618",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.10.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.10.2",
                                "product": {
                                    "name": "vers:unknown/1.10.2",
                                    "product_id": "CSAFPID-998638",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.10.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.11",
                                "product": {
                                    "name": "vers:unknown/1.11",
                                    "product_id": "CSAFPID-998615",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.11"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.11.1",
                                "product": {
                                    "name": "vers:unknown/1.11.1",
                                    "product_id": "CSAFPID-998622",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.11.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.12",
                                "product": {
                                    "name": "vers:unknown/1.12",
                                    "product_id": "CSAFPID-998632",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.12"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.13",
                                "product": {
                                    "name": "vers:unknown/1.13",
                                    "product_id": "CSAFPID-998649",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.13"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.14",
                                "product": {
                                    "name": "vers:unknown/1.14",
                                    "product_id": "CSAFPID-998645",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.14"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.14.1",
                                "product": {
                                    "name": "vers:unknown/1.14.1",
                                    "product_id": "CSAFPID-998621",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.14.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.14.2",
                                "product": {
                                    "name": "vers:unknown/1.14.2",
                                    "product_id": "CSAFPID-998644",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.14.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.14.3",
                                "product": {
                                    "name": "vers:unknown/1.14.3",
                                    "product_id": "CSAFPID-998598",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.14.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.15",
                                "product": {
                                    "name": "vers:unknown/1.15",
                                    "product_id": "CSAFPID-998596",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.15"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.15.1",
                                "product": {
                                    "name": "vers:unknown/1.15.1",
                                    "product_id": "CSAFPID-998641",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.15.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.15.2",
                                "product": {
                                    "name": "vers:unknown/1.15.2",
                                    "product_id": "CSAFPID-998590",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.15.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.15.3",
                                "product": {
                                    "name": "vers:unknown/1.15.3",
                                    "product_id": "CSAFPID-998611",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.15.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.15.4",
                                "product": {
                                    "name": "vers:unknown/1.15.4",
                                    "product_id": "CSAFPID-998630",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.15.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.15.5",
                                "product": {
                                    "name": "vers:unknown/1.15.5",
                                    "product_id": "CSAFPID-998648",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.15.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.15.6",
                                "product": {
                                    "name": "vers:unknown/1.15.6",
                                    "product_id": "CSAFPID-998600",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.15.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16",
                                "product": {
                                    "name": "vers:unknown/1.16",
                                    "product_id": "CSAFPID-998606",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.1",
                                "product": {
                                    "name": "vers:unknown/1.16.1",
                                    "product_id": "CSAFPID-998613",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.10",
                                "product": {
                                    "name": "vers:unknown/1.16.10",
                                    "product_id": "CSAFPID-998599",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.10"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.2",
                                "product": {
                                    "name": "vers:unknown/1.16.2",
                                    "product_id": "CSAFPID-998635",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.3",
                                "product": {
                                    "name": "vers:unknown/1.16.3",
                                    "product_id": "CSAFPID-998623",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.4",
                                "product": {
                                    "name": "vers:unknown/1.16.4",
                                    "product_id": "CSAFPID-998642",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.5",
                                "product": {
                                    "name": "vers:unknown/1.16.5",
                                    "product_id": "CSAFPID-998595",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.6",
                                "product": {
                                    "name": "vers:unknown/1.16.6",
                                    "product_id": "CSAFPID-998610",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.7",
                                "product": {
                                    "name": "vers:unknown/1.16.7",
                                    "product_id": "CSAFPID-998631",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.7"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.8",
                                "product": {
                                    "name": "vers:unknown/1.16.8",
                                    "product_id": "CSAFPID-998628",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.8"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.16.9",
                                "product": {
                                    "name": "vers:unknown/1.16.9",
                                    "product_id": "CSAFPID-998605",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.16.9"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.17",
                                "product": {
                                    "name": "vers:unknown/1.17",
                                    "product_id": "CSAFPID-998624",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.17"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.17.1",
                                "product": {
                                    "name": "vers:unknown/1.17.1",
                                    "product_id": "CSAFPID-998627",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.17.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.18",
                                "product": {
                                    "name": "vers:unknown/1.18",
                                    "product_id": "CSAFPID-998651",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.18"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.18.1",
                                "product": {
                                    "name": "vers:unknown/1.18.1",
                                    "product_id": "CSAFPID-998643",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.18.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.18.2",
                                "product": {
                                    "name": "vers:unknown/1.18.2",
                                    "product_id": "CSAFPID-998594",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.18.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.19",
                                "product": {
                                    "name": "vers:unknown/1.19",
                                    "product_id": "CSAFPID-998603",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.19"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.19.1",
                                "product": {
                                    "name": "vers:unknown/1.19.1",
                                    "product_id": "CSAFPID-998617",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.19.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.19.2",
                                "product": {
                                    "name": "vers:unknown/1.19.2",
                                    "product_id": "CSAFPID-998637",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.19.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.19.3",
                                "product": {
                                    "name": "vers:unknown/1.19.3",
                                    "product_id": "CSAFPID-998620",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.19.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.19.4",
                                "product": {
                                    "name": "vers:unknown/1.19.4",
                                    "product_id": "CSAFPID-3859212",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.19.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.19.5",
                                "product": {
                                    "name": "vers:unknown/1.19.5",
                                    "product_id": "CSAFPID-3859213",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.19.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.19.6",
                                "product": {
                                    "name": "vers:unknown/1.19.6",
                                    "product_id": "CSAFPID-3859214",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.19.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.19.7",
                                "product": {
                                    "name": "vers:unknown/1.19.7",
                                    "product_id": "CSAFPID-3859215",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.19.7"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.2",
                                "product": {
                                    "name": "vers:unknown/1.2",
                                    "product_id": "CSAFPID-998633",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.20",
                                "product": {
                                    "name": "vers:unknown/1.20",
                                    "product_id": "CSAFPID-3859216",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.20"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.20.1",
                                "product": {
                                    "name": "vers:unknown/1.20.1",
                                    "product_id": "CSAFPID-3859217",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.20.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.20.2",
                                "product": {
                                    "name": "vers:unknown/1.20.2",
                                    "product_id": "CSAFPID-3859218",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.20.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.20.3",
                                "product": {
                                    "name": "vers:unknown/1.20.3",
                                    "product_id": "CSAFPID-3859219",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.20.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.20.4",
                                "product": {
                                    "name": "vers:unknown/1.20.4",
                                    "product_id": "CSAFPID-3859220",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.20.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.21.0",
                                "product": {
                                    "name": "vers:unknown/1.21.0",
                                    "product_id": "CSAFPID-3859221",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.21.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.22.0",
                                "product": {
                                    "name": "vers:unknown/1.22.0",
                                    "product_id": "CSAFPID-3859222",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.22.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.22.1",
                                "product": {
                                    "name": "vers:unknown/1.22.1",
                                    "product_id": "CSAFPID-3859223",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.22.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.23.0",
                                "product": {
                                    "name": "vers:unknown/1.23.0",
                                    "product_id": "CSAFPID-3859224",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.23.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.23.1",
                                "product": {
                                    "name": "vers:unknown/1.23.1",
                                    "product_id": "CSAFPID-3859225",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.23.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.24.0",
                                "product": {
                                    "name": "vers:unknown/1.24.0",
                                    "product_id": "CSAFPID-3859226",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.24.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.25.0",
                                "product": {
                                    "name": "vers:unknown/1.25.0",
                                    "product_id": "CSAFPID-3859227",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.25.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.26.0",
                                "product": {
                                    "name": "vers:unknown/1.26.0",
                                    "product_id": "CSAFPID-3859228",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.26.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.27.0",
                                "product": {
                                    "name": "vers:unknown/1.27.0",
                                    "product_id": "CSAFPID-3859229",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.27.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.28.0",
                                "product": {
                                    "name": "vers:unknown/1.28.0",
                                    "product_id": "CSAFPID-3859230",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.28.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.28.1",
                                "product": {
                                    "name": "vers:unknown/1.28.1",
                                    "product_id": "CSAFPID-3859231",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.28.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.29.0",
                                "product": {
                                    "name": "vers:unknown/1.29.0",
                                    "product_id": "CSAFPID-3859232",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.29.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.29.1",
                                "product": {
                                    "name": "vers:unknown/1.29.1",
                                    "product_id": "CSAFPID-3859233",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.29.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.3",
                                "product": {
                                    "name": "vers:unknown/1.3",
                                    "product_id": "CSAFPID-998650",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.0",
                                "product": {
                                    "name": "vers:unknown/1.30.0",
                                    "product_id": "CSAFPID-564865",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.1",
                                "product": {
                                    "name": "vers:unknown/1.30.1",
                                    "product_id": "CSAFPID-3859234",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.10",
                                "product": {
                                    "name": "vers:unknown/1.30.10",
                                    "product_id": "CSAFPID-4960743",
                                    "product_identification_helper": {
                                        "cpe": "cpe:2.3:a:kimai:kimai:1.30.10:*:*:*:*:*:*:*",
                                        "purl": "pkg:composer/kimai/kimai@1.30.10"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.11",
                                "product": {
                                    "name": "vers:unknown/1.30.11",
                                    "product_id": "CSAFPID-4960744",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.11"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.2",
                                "product": {
                                    "name": "vers:unknown/1.30.2",
                                    "product_id": "CSAFPID-4960745",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.3",
                                "product": {
                                    "name": "vers:unknown/1.30.3",
                                    "product_id": "CSAFPID-4960746",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.4",
                                "product": {
                                    "name": "vers:unknown/1.30.4",
                                    "product_id": "CSAFPID-3859235",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.5",
                                "product": {
                                    "name": "vers:unknown/1.30.5",
                                    "product_id": "CSAFPID-4960747",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.6",
                                "product": {
                                    "name": "vers:unknown/1.30.6",
                                    "product_id": "CSAFPID-4960748",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.7",
                                "product": {
                                    "name": "vers:unknown/1.30.7",
                                    "product_id": "CSAFPID-4960749",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.7"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.8",
                                "product": {
                                    "name": "vers:unknown/1.30.8",
                                    "product_id": "CSAFPID-4960750",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.8"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.30.9",
                                "product": {
                                    "name": "vers:unknown/1.30.9",
                                    "product_id": "CSAFPID-4960751",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.30.9"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.4",
                                "product": {
                                    "name": "vers:unknown/1.4",
                                    "product_id": "CSAFPID-998593",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.4.1",
                                "product": {
                                    "name": "vers:unknown/1.4.1",
                                    "product_id": "CSAFPID-998619",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.4.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.4.2",
                                "product": {
                                    "name": "vers:unknown/1.4.2",
                                    "product_id": "CSAFPID-998634",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.4.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.5",
                                "product": {
                                    "name": "vers:unknown/1.5",
                                    "product_id": "CSAFPID-998607",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.6",
                                "product": {
                                    "name": "vers:unknown/1.6",
                                    "product_id": "CSAFPID-998625",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.6.1",
                                "product": {
                                    "name": "vers:unknown/1.6.1",
                                    "product_id": "CSAFPID-998597",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.6.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.6.2",
                                "product": {
                                    "name": "vers:unknown/1.6.2",
                                    "product_id": "CSAFPID-998616",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.6.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.7",
                                "product": {
                                    "name": "vers:unknown/1.7",
                                    "product_id": "CSAFPID-998636",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.7"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.8",
                                "product": {
                                    "name": "vers:unknown/1.8",
                                    "product_id": "CSAFPID-998652",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.8"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/1.9",
                                "product": {
                                    "name": "vers:unknown/1.9",
                                    "product_id": "CSAFPID-998602",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@1.9"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.0",
                                "product": {
                                    "name": "vers:unknown/2.0.0",
                                    "product_id": "CSAFPID-3859236",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.0-alpha",
                                "product": {
                                    "name": "vers:unknown/2.0.0-alpha",
                                    "product_id": "CSAFPID-3859237",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.0-alpha"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.0-beta",
                                "product": {
                                    "name": "vers:unknown/2.0.0-beta",
                                    "product_id": "CSAFPID-3859238",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.0-beta"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.0-beta-2",
                                "product": {
                                    "name": "vers:unknown/2.0.0-beta-2",
                                    "product_id": "CSAFPID-3859239",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.0-beta-2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.0-beta-3",
                                "product": {
                                    "name": "vers:unknown/2.0.0-beta-3",
                                    "product_id": "CSAFPID-3859240",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.0-beta-3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.0-rc-1",
                                "product": {
                                    "name": "vers:unknown/2.0.0-rc-1",
                                    "product_id": "CSAFPID-3859241",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.0-rc-1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.1",
                                "product": {
                                    "name": "vers:unknown/2.0.1",
                                    "product_id": "CSAFPID-3859242",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.10",
                                "product": {
                                    "name": "vers:unknown/2.0.10",
                                    "product_id": "CSAFPID-3859243",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.10"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.11",
                                "product": {
                                    "name": "vers:unknown/2.0.11",
                                    "product_id": "CSAFPID-3859244",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.11"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.12",
                                "product": {
                                    "name": "vers:unknown/2.0.12",
                                    "product_id": "CSAFPID-3859245",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.12"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.13",
                                "product": {
                                    "name": "vers:unknown/2.0.13",
                                    "product_id": "CSAFPID-3859246",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.13"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.14",
                                "product": {
                                    "name": "vers:unknown/2.0.14",
                                    "product_id": "CSAFPID-3859247",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.14"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.15",
                                "product": {
                                    "name": "vers:unknown/2.0.15",
                                    "product_id": "CSAFPID-3859248",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.15"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.16",
                                "product": {
                                    "name": "vers:unknown/2.0.16",
                                    "product_id": "CSAFPID-3859249",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.16"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.17",
                                "product": {
                                    "name": "vers:unknown/2.0.17",
                                    "product_id": "CSAFPID-3859250",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.17"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.18",
                                "product": {
                                    "name": "vers:unknown/2.0.18",
                                    "product_id": "CSAFPID-3859251",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.18"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.19",
                                "product": {
                                    "name": "vers:unknown/2.0.19",
                                    "product_id": "CSAFPID-3859252",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.19"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.2",
                                "product": {
                                    "name": "vers:unknown/2.0.2",
                                    "product_id": "CSAFPID-3859253",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.2"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.20",
                                "product": {
                                    "name": "vers:unknown/2.0.20",
                                    "product_id": "CSAFPID-3859254",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.20"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.21",
                                "product": {
                                    "name": "vers:unknown/2.0.21",
                                    "product_id": "CSAFPID-3859255",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.21"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.22",
                                "product": {
                                    "name": "vers:unknown/2.0.22",
                                    "product_id": "CSAFPID-3859256",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.22"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.23",
                                "product": {
                                    "name": "vers:unknown/2.0.23",
                                    "product_id": "CSAFPID-3859257",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.23"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.24",
                                "product": {
                                    "name": "vers:unknown/2.0.24",
                                    "product_id": "CSAFPID-3859258",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.24"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.25",
                                "product": {
                                    "name": "vers:unknown/2.0.25",
                                    "product_id": "CSAFPID-3859259",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.25"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.26",
                                "product": {
                                    "name": "vers:unknown/2.0.26",
                                    "product_id": "CSAFPID-3859260",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.26"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.27",
                                "product": {
                                    "name": "vers:unknown/2.0.27",
                                    "product_id": "CSAFPID-3859261",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.27"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.28",
                                "product": {
                                    "name": "vers:unknown/2.0.28",
                                    "product_id": "CSAFPID-3859262",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.28"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.29",
                                "product": {
                                    "name": "vers:unknown/2.0.29",
                                    "product_id": "CSAFPID-3859263",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.29"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.3",
                                "product": {
                                    "name": "vers:unknown/2.0.3",
                                    "product_id": "CSAFPID-3859264",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.3"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.30",
                                "product": {
                                    "name": "vers:unknown/2.0.30",
                                    "product_id": "CSAFPID-3859265",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.30"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.31",
                                "product": {
                                    "name": "vers:unknown/2.0.31",
                                    "product_id": "CSAFPID-3859266",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.31"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.32",
                                "product": {
                                    "name": "vers:unknown/2.0.32",
                                    "product_id": "CSAFPID-3859267",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.32"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.33",
                                "product": {
                                    "name": "vers:unknown/2.0.33",
                                    "product_id": "CSAFPID-3859268",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.33"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.34",
                                "product": {
                                    "name": "vers:unknown/2.0.34",
                                    "product_id": "CSAFPID-3859269",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.34"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.35",
                                "product": {
                                    "name": "vers:unknown/2.0.35",
                                    "product_id": "CSAFPID-3859270",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.35"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.4",
                                "product": {
                                    "name": "vers:unknown/2.0.4",
                                    "product_id": "CSAFPID-3859271",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.4"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.5",
                                "product": {
                                    "name": "vers:unknown/2.0.5",
                                    "product_id": "CSAFPID-3859272",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.5"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.6",
                                "product": {
                                    "name": "vers:unknown/2.0.6",
                                    "product_id": "CSAFPID-3859273",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.6"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.7",
                                "product": {
                                    "name": "vers:unknown/2.0.7",
                                    "product_id": "CSAFPID-3859274",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.7"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.8",
                                "product": {
                                    "name": "vers:unknown/2.0.8",
                                    "product_id": "CSAFPID-3859275",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.8"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.0.9",
                                "product": {
                                    "name": "vers:unknown/2.0.9",
                                    "product_id": "CSAFPID-3859276",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.0.9"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.1.0",
                                "product": {
                                    "name": "vers:unknown/2.1.0",
                                    "product_id": "CSAFPID-3859277",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.1.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.10.0",
                                "product": {
                                    "name": "vers:unknown/2.10.0",
                                    "product_id": "CSAFPID-3859278",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.10.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.11.0",
                                "product": {
                                    "name": "vers:unknown/2.11.0",
                                    "product_id": "CSAFPID-3859279",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.11.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.12.0",
                                "product": {
                                    "name": "vers:unknown/2.12.0",
                                    "product_id": "CSAFPID-3859280",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.12.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.13.0",
                                "product": {
                                    "name": "vers:unknown/2.13.0",
                                    "product_id": "CSAFPID-3859281",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.13.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.14.0",
                                "product": {
                                    "name": "vers:unknown/2.14.0",
                                    "product_id": "CSAFPID-3859282",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.14.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.15.0",
                                "product": {
                                    "name": "vers:unknown/2.15.0",
                                    "product_id": "CSAFPID-1120717",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.15.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.16.0",
                                "product": {
                                    "name": "vers:unknown/2.16.0",
                                    "product_id": "CSAFPID-5036430",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.16.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.16.1",
                                "product": {
                                    "name": "vers:unknown/2.16.1",
                                    "product_id": "CSAFPID-5446620",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.16.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.17.0",
                                "product": {
                                    "name": "vers:unknown/2.17.0",
                                    "product_id": "CSAFPID-5446621",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.17.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.18.0",
                                "product": {
                                    "name": "vers:unknown/2.18.0",
                                    "product_id": "CSAFPID-5446622",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.18.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.19.0",
                                "product": {
                                    "name": "vers:unknown/2.19.0",
                                    "product_id": "CSAFPID-5446623",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.19.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.19.1",
                                "product": {
                                    "name": "vers:unknown/2.19.1",
                                    "product_id": "CSAFPID-5446624",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.19.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.2.0",
                                "product": {
                                    "name": "vers:unknown/2.2.0",
                                    "product_id": "CSAFPID-3859283",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.2.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.2.1",
                                "product": {
                                    "name": "vers:unknown/2.2.1",
                                    "product_id": "CSAFPID-3859284",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.2.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.20.0",
                                "product": {
                                    "name": "vers:unknown/2.20.0",
                                    "product_id": "CSAFPID-5446625",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.20.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.20.1",
                                "product": {
                                    "name": "vers:unknown/2.20.1",
                                    "product_id": "CSAFPID-5446626",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.20.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.21.0",
                                "product": {
                                    "name": "vers:unknown/2.21.0",
                                    "product_id": "CSAFPID-5446627",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.21.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.22.0",
                                "product": {
                                    "name": "vers:unknown/2.22.0",
                                    "product_id": "CSAFPID-5446628",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.22.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.23.0",
                                "product": {
                                    "name": "vers:unknown/2.23.0",
                                    "product_id": "CSAFPID-5446629",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.23.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.24.0",
                                "product": {
                                    "name": "vers:unknown/2.24.0",
                                    "product_id": "CSAFPID-5446630",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.24.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.25.0",
                                "product": {
                                    "name": "vers:unknown/2.25.0",
                                    "product_id": "CSAFPID-5446631",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.25.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.26.0",
                                "product": {
                                    "name": "vers:unknown/2.26.0",
                                    "product_id": "CSAFPID-5446632",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.26.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.27.0",
                                "product": {
                                    "name": "vers:unknown/2.27.0",
                                    "product_id": "CSAFPID-5446633",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.27.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.28.0",
                                "product": {
                                    "name": "vers:unknown/2.28.0",
                                    "product_id": "CSAFPID-5446634",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.28.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.29.0",
                                "product": {
                                    "name": "vers:unknown/2.29.0",
                                    "product_id": "CSAFPID-5446635",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.29.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.3.0",
                                "product": {
                                    "name": "vers:unknown/2.3.0",
                                    "product_id": "CSAFPID-3859285",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.3.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.30.0",
                                "product": {
                                    "name": "vers:unknown/2.30.0",
                                    "product_id": "CSAFPID-5446636",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.30.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.31.0",
                                "product": {
                                    "name": "vers:unknown/2.31.0",
                                    "product_id": "CSAFPID-5446637",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.31.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.32.0",
                                "product": {
                                    "name": "vers:unknown/2.32.0",
                                    "product_id": "CSAFPID-5446638",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.32.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.33.0",
                                "product": {
                                    "name": "vers:unknown/2.33.0",
                                    "product_id": "CSAFPID-5446639",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.33.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.34.0",
                                "product": {
                                    "name": "vers:unknown/2.34.0",
                                    "product_id": "CSAFPID-5446640",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.34.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.35.0",
                                "product": {
                                    "name": "vers:unknown/2.35.0",
                                    "product_id": "CSAFPID-5446641",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.35.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.35.1",
                                "product": {
                                    "name": "vers:unknown/2.35.1",
                                    "product_id": "CSAFPID-5446642",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.35.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.36.0",
                                "product": {
                                    "name": "vers:unknown/2.36.0",
                                    "product_id": "CSAFPID-5446643",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.36.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.36.1",
                                "product": {
                                    "name": "vers:unknown/2.36.1",
                                    "product_id": "CSAFPID-5446644",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.36.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.37.0",
                                "product": {
                                    "name": "vers:unknown/2.37.0",
                                    "product_id": "CSAFPID-5446645",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.37.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.38.0",
                                "product": {
                                    "name": "vers:unknown/2.38.0",
                                    "product_id": "CSAFPID-5446646",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.38.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.39.0",
                                "product": {
                                    "name": "vers:unknown/2.39.0",
                                    "product_id": "CSAFPID-5446647",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.39.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.4.0",
                                "product": {
                                    "name": "vers:unknown/2.4.0",
                                    "product_id": "CSAFPID-3859286",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.4.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.4.1",
                                "product": {
                                    "name": "vers:unknown/2.4.1",
                                    "product_id": "CSAFPID-3859287",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.4.1"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.40.0",
                                "product": {
                                    "name": "vers:unknown/2.40.0",
                                    "product_id": "CSAFPID-5446648",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.40.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.41.0",
                                "product": {
                                    "name": "vers:unknown/2.41.0",
                                    "product_id": "CSAFPID-5446649",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.41.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.42.0",
                                "product": {
                                    "name": "vers:unknown/2.42.0",
                                    "product_id": "CSAFPID-5446650",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.42.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.43.0",
                                "product": {
                                    "name": "vers:unknown/2.43.0",
                                    "product_id": "CSAFPID-5446651",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.43.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.44.0",
                                "product": {
                                    "name": "vers:unknown/2.44.0",
                                    "product_id": "CSAFPID-5446652",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.44.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.45.0",
                                "product": {
                                    "name": "vers:unknown/2.45.0",
                                    "product_id": "CSAFPID-5446653",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.45.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.46.0",
                                "product": {
                                    "name": "vers:unknown/2.46.0",
                                    "product_id": "CSAFPID-5760044",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.46.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.47.0",
                                "product": {
                                    "name": "vers:unknown/2.47.0",
                                    "product_id": "CSAFPID-5760045",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.47.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.48.0",
                                "product": {
                                    "name": "vers:unknown/2.48.0",
                                    "product_id": "CSAFPID-5760046",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.48.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.49.0",
                                "product": {
                                    "name": "vers:unknown/2.49.0",
                                    "product_id": "CSAFPID-5760047",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.49.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.5.0",
                                "product": {
                                    "name": "vers:unknown/2.5.0",
                                    "product_id": "CSAFPID-3859288",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.5.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.50.0",
                                "product": {
                                    "name": "vers:unknown/2.50.0",
                                    "product_id": "CSAFPID-5760048",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.50.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.6.0",
                                "product": {
                                    "name": "vers:unknown/2.6.0",
                                    "product_id": "CSAFPID-3859289",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.6.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.7.0",
                                "product": {
                                    "name": "vers:unknown/2.7.0",
                                    "product_id": "CSAFPID-3859290",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.7.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.8.0",
                                "product": {
                                    "name": "vers:unknown/2.8.0",
                                    "product_id": "CSAFPID-3859291",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.8.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/2.9.0",
                                "product": {
                                    "name": "vers:unknown/2.9.0",
                                    "product_id": "CSAFPID-3859292",
                                    "product_identification_helper": {
                                        "purl": "pkg:composer/kimai/kimai@2.9.0"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<2.51.0",
                                "product": {
                                    "name": "vers:unknown/<2.51.0",
                                    "product_id": "CSAFPID-5765417",
                                    "product_identification_helper": {
                                        "cpe": "cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*"
                                    }
                                }
                            },
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/>=0|<2.51.0",
                                "product": {
                                    "name": "vers:unknown/>=0|<2.51.0",
                                    "product_id": "CSAFPID-5760049"
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "kimai"
                    }
                ],
                "category": "vendor",
                "name": "kimai"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-28685",
            "cwe": {
                "id": "CWE-862",
                "name": "Missing Authorization"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "## Summary\n\n`GET /api/invoices/{id}` only checks the role-based `view_invoice` permission but does not verify the requesting user has `access` to the invoice's customer. Any user with `ROLE_TEAMLEAD` (which grants `view_invoice`) can read all invoices in the system, including those belonging to customers assigned to other teams.\n\n## Affected Code\n\n`src/API/InvoiceController.php` line 92-101:\n\n```php\n#[IsGranted('view_invoice')]           // Role check only, no customer access check\n#[Route(methods: ['GET'], path: '/{id}', name: 'get_invoice', requirements: ['id' => '\\d+'])]\npublic function getAction(Invoice $invoice): Response\n{\n    $view = new View($invoice, 200);\n    $view->getContext()->setGroups(self::GROUPS_ENTITY);\n    return $this->viewHandler->handle($view);  // Returns ANY invoice by ID\n}\n```\n\nThe web controller (`src/Controller/InvoiceController.php` line 304-307) correctly checks customer access:\n\n```php\n#[IsGranted('view_invoice')]\n#[IsGranted(new Expression(\"is_granted('access', subject.getCustomer())\"), 'invoice')]\npublic function downloadAction(Invoice $invoice, ...): Response { ... }\n```\n\nThe `access` attribute in `CustomerVoter` (line 71-87) verifies team membership, but this check is entirely missing from the API endpoint.\n\n## PoC\n\nTested against Kimai v2.50.0 (Docker: `kimai/kimai2:apache`).\n\nSetup:\n- TeamA with CustomerA (\"SecretCorp\"), TeamB with CustomerB (\"BobCorp\")\n- Bob is a teamlead in TeamB only\n- An invoice exists for SecretCorp (TeamA)\n\n```bash\n# Bob (TeamB) reads SecretCorp (TeamA) invoice\ncurl -H \"Authorization: Bearer BOB_TOKEN\" http://localhost:8888/api/invoices/1\n```\n\nResponse (200 OK):\n```json\n{\n  \"invoiceNumber\": \"INV-2026-001\",\n  \"total\": 15000.0,\n  \"currency\": \"USD\",\n  \"customer\": {\"name\": \"SecretCorp\", ...}\n}\n```\n\nBob can also enumerate all invoices via `GET /api/invoices` — the list endpoint uses `setCurrentUser()` in the query but the single-item endpoint bypasses this entirely via Symfony ParamConverter.\n\n## Impact\n\nAny teamlead can read all invoices across the system regardless of team assignment. Invoice data typically contains sensitive financial information (amounts, customer details, payment terms). In multi-team deployments this breaks the intended data isolation between teams.\n\n## Suggested Fix\n\nAdd the customer access check to the API endpoint, matching the web controller:\n\n```diff\n #[IsGranted('view_invoice')]\n+#[IsGranted(new Expression(\"is_granted('access', subject.getCustomer())\"), 'invoice')]\n #[Route(methods: ['GET'], path: '/{id}', name: 'get_invoice')]\n public function getAction(Invoice $invoice): Response\n```",
                    "title": "github - https://github.com/advisories/GHSA-v33r-r6h2-8wr7"
                },
                {
                    "category": "description",
                    "text": "## Summary\n\n`GET /api/invoices/{id}` only checks the role-based `view_invoice` permission but does not verify the requesting user has `access` to the invoice's customer. Any user with `ROLE_TEAMLEAD` (which grants `view_invoice`) can read all invoices in the system, including those belonging to customers assigned to other teams.\n\n## Affected Code\n\n`src/API/InvoiceController.php` line 92-101:\n\n```php\n#[IsGranted('view_invoice')]           // Role check only, no customer access check\n#[Route(methods: ['GET'], path: '/{id}', name: 'get_invoice', requirements: ['id' => '\\d+'])]\npublic function getAction(Invoice $invoice): Response\n{\n    $view = new View($invoice, 200);\n    $view->getContext()->setGroups(self::GROUPS_ENTITY);\n    return $this->viewHandler->handle($view);  // Returns ANY invoice by ID\n}\n```\n\nThe web controller (`src/Controller/InvoiceController.php` line 304-307) correctly checks customer access:\n\n```php\n#[IsGranted('view_invoice')]\n#[IsGranted(new Expression(\"is_granted('access', subject.getCustomer())\"), 'invoice')]\npublic function downloadAction(Invoice $invoice, ...): Response { ... }\n```\n\nThe `access` attribute in `CustomerVoter` (line 71-87) verifies team membership, but this check is entirely missing from the API endpoint.\n\n## PoC\n\nTested against Kimai v2.50.0 (Docker: `kimai/kimai2:apache`).\n\nSetup:\n- TeamA with CustomerA (\"SecretCorp\"), TeamB with CustomerB (\"BobCorp\")\n- Bob is a teamlead in TeamB only\n- An invoice exists for SecretCorp (TeamA)\n\n```bash\n# Bob (TeamB) reads SecretCorp (TeamA) invoice\ncurl -H \"Authorization: Bearer BOB_TOKEN\" http://localhost:8888/api/invoices/1\n```\n\nResponse (200 OK):\n```json\n{\n  \"invoiceNumber\": \"INV-2026-001\",\n  \"total\": 15000.0,\n  \"currency\": \"USD\",\n  \"customer\": {\"name\": \"SecretCorp\", ...}\n}\n```\n\nBob can also enumerate all invoices via `GET /api/invoices` — the list endpoint uses `setCurrentUser()` in the query but the single-item endpoint bypasses this entirely via Symfony ParamConverter.\n\n## Impact\n\nAny teamlead can read all invoices across the system regardless of team assignment. Invoice data typically contains sensitive financial information (amounts, customer details, payment terms). In multi-team deployments this breaks the intended data isolation between teams.\n\n## Suggested Fix\n\nAdd the customer access check to the API endpoint, matching the web controller:\n\n```diff\n #[IsGranted('view_invoice')]\n+#[IsGranted(new Expression(\"is_granted('access', subject.getCustomer())\"), 'invoice')]\n #[Route(methods: ['GET'], path: '/{id}', name: 'get_invoice')]\n public function getAction(Invoice $invoice): Response\n```",
                    "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-v33r-r6h2-8wr7.json?alt=media"
                },
                {
                    "category": "description",
                    "text": "Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, \"GET /api/invoices/{id}\" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.",
                    "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-28685"
                },
                {
                    "category": "description",
                    "text": "Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, \"GET /api/invoices/{id}\" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.",
                    "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-28685"
                },
                {
                    "category": "other",
                    "text": "0.00033",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "3.6",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "The value of the most recent EPSS score, There is exploit data available from source Nvd, Is related to (a version of) an uncommon product",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-564865",
                    "CSAFPID-998590",
                    "CSAFPID-998591",
                    "CSAFPID-998592",
                    "CSAFPID-998593",
                    "CSAFPID-998594",
                    "CSAFPID-998595",
                    "CSAFPID-998596",
                    "CSAFPID-998597",
                    "CSAFPID-998598",
                    "CSAFPID-998599",
                    "CSAFPID-998600",
                    "CSAFPID-998601",
                    "CSAFPID-998602",
                    "CSAFPID-998603",
                    "CSAFPID-998604",
                    "CSAFPID-998605",
                    "CSAFPID-998606",
                    "CSAFPID-998607",
                    "CSAFPID-998608",
                    "CSAFPID-998609",
                    "CSAFPID-998610",
                    "CSAFPID-998611",
                    "CSAFPID-998612",
                    "CSAFPID-998613",
                    "CSAFPID-998614",
                    "CSAFPID-998615",
                    "CSAFPID-998616",
                    "CSAFPID-998617",
                    "CSAFPID-998618",
                    "CSAFPID-998619",
                    "CSAFPID-998620",
                    "CSAFPID-998621",
                    "CSAFPID-998622",
                    "CSAFPID-998623",
                    "CSAFPID-998624",
                    "CSAFPID-998625",
                    "CSAFPID-998626",
                    "CSAFPID-998627",
                    "CSAFPID-998628",
                    "CSAFPID-998629",
                    "CSAFPID-998630",
                    "CSAFPID-998631",
                    "CSAFPID-998632",
                    "CSAFPID-998633",
                    "CSAFPID-998634",
                    "CSAFPID-998635",
                    "CSAFPID-998636",
                    "CSAFPID-998637",
                    "CSAFPID-998638",
                    "CSAFPID-998639",
                    "CSAFPID-998640",
                    "CSAFPID-998641",
                    "CSAFPID-998642",
                    "CSAFPID-998643",
                    "CSAFPID-998644",
                    "CSAFPID-998645",
                    "CSAFPID-998646",
                    "CSAFPID-998647",
                    "CSAFPID-998648",
                    "CSAFPID-998649",
                    "CSAFPID-998650",
                    "CSAFPID-998651",
                    "CSAFPID-998652",
                    "CSAFPID-998653",
                    "CSAFPID-1120717",
                    "CSAFPID-3859212",
                    "CSAFPID-3859213",
                    "CSAFPID-3859214",
                    "CSAFPID-3859215",
                    "CSAFPID-3859216",
                    "CSAFPID-3859217",
                    "CSAFPID-3859218",
                    "CSAFPID-3859219",
                    "CSAFPID-3859220",
                    "CSAFPID-3859221",
                    "CSAFPID-3859222",
                    "CSAFPID-3859223",
                    "CSAFPID-3859224",
                    "CSAFPID-3859225",
                    "CSAFPID-3859226",
                    "CSAFPID-3859227",
                    "CSAFPID-3859228",
                    "CSAFPID-3859229",
                    "CSAFPID-3859230",
                    "CSAFPID-3859231",
                    "CSAFPID-3859232",
                    "CSAFPID-3859233",
                    "CSAFPID-3859234",
                    "CSAFPID-3859235",
                    "CSAFPID-3859236",
                    "CSAFPID-3859237",
                    "CSAFPID-3859238",
                    "CSAFPID-3859239",
                    "CSAFPID-3859240",
                    "CSAFPID-3859241",
                    "CSAFPID-3859242",
                    "CSAFPID-3859243",
                    "CSAFPID-3859244",
                    "CSAFPID-3859245",
                    "CSAFPID-3859246",
                    "CSAFPID-3859247",
                    "CSAFPID-3859248",
                    "CSAFPID-3859249",
                    "CSAFPID-3859250",
                    "CSAFPID-3859251",
                    "CSAFPID-3859252",
                    "CSAFPID-3859253",
                    "CSAFPID-3859254",
                    "CSAFPID-3859255",
                    "CSAFPID-3859256",
                    "CSAFPID-3859257",
                    "CSAFPID-3859258",
                    "CSAFPID-3859259",
                    "CSAFPID-3859260",
                    "CSAFPID-3859261",
                    "CSAFPID-3859262",
                    "CSAFPID-3859263",
                    "CSAFPID-3859264",
                    "CSAFPID-3859265",
                    "CSAFPID-3859266",
                    "CSAFPID-3859267",
                    "CSAFPID-3859268",
                    "CSAFPID-3859269",
                    "CSAFPID-3859270",
                    "CSAFPID-3859271",
                    "CSAFPID-3859272",
                    "CSAFPID-3859273",
                    "CSAFPID-3859274",
                    "CSAFPID-3859275",
                    "CSAFPID-3859276",
                    "CSAFPID-3859277",
                    "CSAFPID-3859278",
                    "CSAFPID-3859279",
                    "CSAFPID-3859280",
                    "CSAFPID-3859281",
                    "CSAFPID-3859282",
                    "CSAFPID-3859283",
                    "CSAFPID-3859284",
                    "CSAFPID-3859285",
                    "CSAFPID-3859286",
                    "CSAFPID-3859287",
                    "CSAFPID-3859288",
                    "CSAFPID-3859289",
                    "CSAFPID-3859290",
                    "CSAFPID-3859291",
                    "CSAFPID-3859292",
                    "CSAFPID-4960743",
                    "CSAFPID-4960744",
                    "CSAFPID-4960745",
                    "CSAFPID-4960746",
                    "CSAFPID-4960747",
                    "CSAFPID-4960748",
                    "CSAFPID-4960749",
                    "CSAFPID-4960750",
                    "CSAFPID-4960751",
                    "CSAFPID-5036430",
                    "CSAFPID-5446620",
                    "CSAFPID-5446621",
                    "CSAFPID-5446622",
                    "CSAFPID-5446623",
                    "CSAFPID-5446624",
                    "CSAFPID-5446625",
                    "CSAFPID-5446626",
                    "CSAFPID-5446627",
                    "CSAFPID-5446628",
                    "CSAFPID-5446629",
                    "CSAFPID-5446630",
                    "CSAFPID-5446631",
                    "CSAFPID-5446632",
                    "CSAFPID-5446633",
                    "CSAFPID-5446634",
                    "CSAFPID-5446635",
                    "CSAFPID-5446636",
                    "CSAFPID-5446637",
                    "CSAFPID-5446638",
                    "CSAFPID-5446639",
                    "CSAFPID-5446640",
                    "CSAFPID-5446641",
                    "CSAFPID-5446642",
                    "CSAFPID-5446643",
                    "CSAFPID-5446644",
                    "CSAFPID-5446645",
                    "CSAFPID-5446646",
                    "CSAFPID-5446647",
                    "CSAFPID-5446648",
                    "CSAFPID-5446649",
                    "CSAFPID-5446650",
                    "CSAFPID-5446651",
                    "CSAFPID-5446652",
                    "CSAFPID-5446653",
                    "CSAFPID-5760044",
                    "CSAFPID-5760045",
                    "CSAFPID-5760046",
                    "CSAFPID-5760047",
                    "CSAFPID-5760048",
                    "CSAFPID-5760049",
                    "CSAFPID-5765417"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://github.com/advisories/GHSA-v33r-r6h2-8wr7"
                },
                {
                    "category": "external",
                    "summary": "Source raw - github",
                    "url": "https://api.github.com/advisories/GHSA-v33r-r6h2-8wr7"
                },
                {
                    "category": "external",
                    "summary": "Source - osv",
                    "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-v33r-r6h2-8wr7.json?alt=media"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28685"
                },
                {
                    "category": "external",
                    "summary": "Source raw - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-28685"
                },
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-28685"
                },
                {
                    "category": "external",
                    "summary": "Source raw - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/28xxx/CVE-2026-28685.json"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-28685"
                },
                {
                    "category": "external",
                    "summary": "Source raw - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/kimai/kimai/security/advisories/GHSA-v33r-r6h2-8wr7"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/kimai/kimai/commit/a0601c8cb28fed1cca19051a8272425069ab758f"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd; osv",
                    "url": "https://github.com/kimai/kimai/releases/tag/2.51.0"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://github.com/advisories/GHSA-v33r-r6h2-8wr7"
                },
                {
                    "category": "external",
                    "summary": "Reference - github; osv",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28685"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                        "baseScore": 6.5,
                        "baseSeverity": "MEDIUM"
                    },
                    "products": [
                        "CSAFPID-1120717",
                        "CSAFPID-3859212",
                        "CSAFPID-3859213",
                        "CSAFPID-3859214",
                        "CSAFPID-3859215",
                        "CSAFPID-3859216",
                        "CSAFPID-3859217",
                        "CSAFPID-3859218",
                        "CSAFPID-3859219",
                        "CSAFPID-3859220",
                        "CSAFPID-3859221",
                        "CSAFPID-3859222",
                        "CSAFPID-3859223",
                        "CSAFPID-3859224",
                        "CSAFPID-3859225",
                        "CSAFPID-3859226",
                        "CSAFPID-3859227",
                        "CSAFPID-3859228",
                        "CSAFPID-3859229",
                        "CSAFPID-3859230",
                        "CSAFPID-3859231",
                        "CSAFPID-3859232",
                        "CSAFPID-3859233",
                        "CSAFPID-3859234",
                        "CSAFPID-3859235",
                        "CSAFPID-3859236",
                        "CSAFPID-3859237",
                        "CSAFPID-3859238",
                        "CSAFPID-3859239",
                        "CSAFPID-3859240",
                        "CSAFPID-3859241",
                        "CSAFPID-3859242",
                        "CSAFPID-3859243",
                        "CSAFPID-3859244",
                        "CSAFPID-3859245",
                        "CSAFPID-3859246",
                        "CSAFPID-3859247",
                        "CSAFPID-3859248",
                        "CSAFPID-3859249",
                        "CSAFPID-3859250",
                        "CSAFPID-3859251",
                        "CSAFPID-3859252",
                        "CSAFPID-3859253",
                        "CSAFPID-3859254",
                        "CSAFPID-3859255",
                        "CSAFPID-3859256",
                        "CSAFPID-3859257",
                        "CSAFPID-3859258",
                        "CSAFPID-3859259",
                        "CSAFPID-3859260",
                        "CSAFPID-3859261",
                        "CSAFPID-3859262",
                        "CSAFPID-3859263",
                        "CSAFPID-3859264",
                        "CSAFPID-3859265",
                        "CSAFPID-3859266",
                        "CSAFPID-3859267",
                        "CSAFPID-3859268",
                        "CSAFPID-3859269",
                        "CSAFPID-3859270",
                        "CSAFPID-3859271",
                        "CSAFPID-3859272",
                        "CSAFPID-3859273",
                        "CSAFPID-3859274",
                        "CSAFPID-3859275",
                        "CSAFPID-3859276",
                        "CSAFPID-3859277",
                        "CSAFPID-3859278",
                        "CSAFPID-3859279",
                        "CSAFPID-3859280",
                        "CSAFPID-3859281",
                        "CSAFPID-3859282",
                        "CSAFPID-3859283",
                        "CSAFPID-3859284",
                        "CSAFPID-3859285",
                        "CSAFPID-3859286",
                        "CSAFPID-3859287",
                        "CSAFPID-3859288",
                        "CSAFPID-3859289",
                        "CSAFPID-3859290",
                        "CSAFPID-3859291",
                        "CSAFPID-3859292",
                        "CSAFPID-4960743",
                        "CSAFPID-4960744",
                        "CSAFPID-4960745",
                        "CSAFPID-4960746",
                        "CSAFPID-4960747",
                        "CSAFPID-4960748",
                        "CSAFPID-4960749",
                        "CSAFPID-4960750",
                        "CSAFPID-4960751",
                        "CSAFPID-5036430",
                        "CSAFPID-5446620",
                        "CSAFPID-5446621",
                        "CSAFPID-5446622",
                        "CSAFPID-5446623",
                        "CSAFPID-5446624",
                        "CSAFPID-5446625",
                        "CSAFPID-5446626",
                        "CSAFPID-5446627",
                        "CSAFPID-5446628",
                        "CSAFPID-5446629",
                        "CSAFPID-5446630",
                        "CSAFPID-5446631",
                        "CSAFPID-5446632",
                        "CSAFPID-5446633",
                        "CSAFPID-5446634",
                        "CSAFPID-5446635",
                        "CSAFPID-5446636",
                        "CSAFPID-5446637",
                        "CSAFPID-5446638",
                        "CSAFPID-5446639",
                        "CSAFPID-5446640",
                        "CSAFPID-5446641",
                        "CSAFPID-5446642",
                        "CSAFPID-5446643",
                        "CSAFPID-5446644",
                        "CSAFPID-5446645",
                        "CSAFPID-5446646",
                        "CSAFPID-5446647",
                        "CSAFPID-5446648",
                        "CSAFPID-5446649",
                        "CSAFPID-5446650",
                        "CSAFPID-5446651",
                        "CSAFPID-5446652",
                        "CSAFPID-5446653",
                        "CSAFPID-564865",
                        "CSAFPID-5760044",
                        "CSAFPID-5760045",
                        "CSAFPID-5760046",
                        "CSAFPID-5760047",
                        "CSAFPID-5760048",
                        "CSAFPID-5760049",
                        "CSAFPID-5765417",
                        "CSAFPID-998590",
                        "CSAFPID-998591",
                        "CSAFPID-998592",
                        "CSAFPID-998593",
                        "CSAFPID-998594",
                        "CSAFPID-998595",
                        "CSAFPID-998596",
                        "CSAFPID-998597",
                        "CSAFPID-998598",
                        "CSAFPID-998599",
                        "CSAFPID-998600",
                        "CSAFPID-998601",
                        "CSAFPID-998602",
                        "CSAFPID-998603",
                        "CSAFPID-998604",
                        "CSAFPID-998605",
                        "CSAFPID-998606",
                        "CSAFPID-998607",
                        "CSAFPID-998608",
                        "CSAFPID-998609",
                        "CSAFPID-998610",
                        "CSAFPID-998611",
                        "CSAFPID-998612",
                        "CSAFPID-998613",
                        "CSAFPID-998614",
                        "CSAFPID-998615",
                        "CSAFPID-998616",
                        "CSAFPID-998617",
                        "CSAFPID-998618",
                        "CSAFPID-998619",
                        "CSAFPID-998620",
                        "CSAFPID-998621",
                        "CSAFPID-998622",
                        "CSAFPID-998623",
                        "CSAFPID-998624",
                        "CSAFPID-998625",
                        "CSAFPID-998626",
                        "CSAFPID-998627",
                        "CSAFPID-998628",
                        "CSAFPID-998629",
                        "CSAFPID-998630",
                        "CSAFPID-998631",
                        "CSAFPID-998632",
                        "CSAFPID-998633",
                        "CSAFPID-998634",
                        "CSAFPID-998635",
                        "CSAFPID-998636",
                        "CSAFPID-998637",
                        "CSAFPID-998638",
                        "CSAFPID-998639",
                        "CSAFPID-998640",
                        "CSAFPID-998641",
                        "CSAFPID-998642",
                        "CSAFPID-998643",
                        "CSAFPID-998644",
                        "CSAFPID-998645",
                        "CSAFPID-998646",
                        "CSAFPID-998647",
                        "CSAFPID-998648",
                        "CSAFPID-998649",
                        "CSAFPID-998650",
                        "CSAFPID-998651",
                        "CSAFPID-998652",
                        "CSAFPID-998653"
                    ]
                }
            ],
            "title": "CVE-2026-28685"
        }
    ]
}