Read the docs
TI-2026-37927 Aliases CVE-2026-52819GHSA-4m8q-55qv-9pwp

Incorrect authorization in kimai

Priority MEDIUM 61CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Kimai is an open-source time tracking application. Prior to 2.57.0, the GET /api/timesheets list endpoint accepts user and users[] target identifiers from a caller with view_other_timesheet but does not apply access_user or verify that a ROLE_TEAMLEAD requester leads a team containing each target user. TimesheetController::cgetAction() adds the resolved users directly to the query while project and customer filtering still permits records on unscoped projects or projects sharing ordinary team membership, allowing a teamlead to retrieve another user's descriptions, timing data, tags, rate, and internalRate even though GET /api/timesheets/{id} would deny access through TimesheetVoter. This issue is fixed in version 2.57.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00496 42nd percentileScored 2026-11-07
Fix Fixed kimai (kimai): 2.57.0kimai/kimai (Packagist): 2.57.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kimaikimaibefore 2.57.02.57.0Patch availableCNA
—kimai/kimai (Packagist)before 2.57.02.57.0Patch availableGHSA-4m8q-55qv-9pwp
  • kimai Vendorkimai Affected before 2.57.0 Fixed in 2.57.0 Patch available CNA
  • kimai/kimai (Packagist) Vendor— Affected before 2.57.0 Fixed in 2.57.0 Patch available GHSA-4m8q-55qv-9pwp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:*——kimai
  • cpe:2.3:a:kimai:kimai:*:*:*:*:*:*:*:* Versions — — ·kimai

Remediation

  • Fix · CNA kimai (kimai) Fixed in 2.57.0
  • Fix · GHSA-4m8q-55qv-9pwp kimai/kimai (Packagist) Fixed in 2.57.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52819
  2. 2026-10-03 Alias added: GHSA-4m8q-55qv-9pwp

References

Other 6

  • TI-2023-30240 Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking CVSS 4.0HIGH 8.5
  • TI-2026-55437 Kimai before 2.58.0 Authentication Bypass via Password Reset Link CVSS 4.0HIGH 8.7
  • TI-2026-55443 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter CVSS 4.0CRITICAL 9.3
  • TI-2026-22900 Kimai: API invoice endpoint missing customer-level access control (IDOR) CVSS 3.1MEDIUM 6.5
  • TI-2026-55440 Kimai before 2.54.0 Username Enumeration via Timing Oracle CVSS 4.0MEDIUM 6.3
  • TI-2026-30580 Kimai: Formula Injection via tag names in XLSX export CVSS 4.0MEDIUM 5.4
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences