CVE-2026-28685 Details
Description
Kimai is a web-based multi-user time-tracking application. Prior to version 2.51.0, "GET /api/invoices/{id}" only checks the role-based view_invoice permission but does not verify the requesting user has access to the invoice's customer. Any user with ROLE_TEAMLEAD (which grants view_invoice) can read all invoices in the system, including those belonging to customers assigned to other teams. This issue has been patched in version 2.51.0.
A vulnerability exists in Kimai, a web-based time-tracking application, in versions prior to 2.51.0. The issue arises in the Invoices API endpoint, which fails to properly verify customer-level access for users with the ROLE_TEAMLEAD. This oversight allows such users to access all invoices across the system, including those from customers of other teams. The vulnerability stems from the API only checking the role-based view_invoice permission without confirming if the user has access to the invoice's customer. This lack of access control can lead to unauthorized visibility of sensitive financial information, disrupting data isolation between teams in multi-team deployments.
Users can update to Kimai version 2.51.0, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kimai/kimai/commit/a0601c8cb28fed1cca19051a8272425069ab758f | [email protected] | Patch |
| https://github.com/kimai/kimai/releases/tag/2.51.0 | [email protected] | ProductRelease Notes |
| https://github.com/kimai/kimai/security/advisories/GHSA-v33r-r6h2-8wr7 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kimai kimai | < 2.51.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |