Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: kimai 2.56.0 Clear all filters
TI-2026-55443 CVE-2026-80202 · GHSA-fx95-9ppf-x8wm

Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

Priority HIGH 75

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00392 Published 2026-08-25 Fixed in 2.56.0 CWE-863
TI-2026-55439 CVE-2026-80198 · GHSA-w754-75mx-556q

Kimai before 2.56.0 Information Disclosure via config() Twig Function

Priority MEDIUM 44

Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00432 Published 2026-08-25 Fixed in 2.56.0 CWE-693