CVE-2026-52820 Details
Description
Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identifier through TimesheetApiEditForm and FormTrait, and ProjectRepository::getQueryBuilderForFormType() places that identifier in an unconditional OR branch that bypasses the team access criteria. Any authenticated user with edit_own_timesheet can therefore assign an owned timesheet to a project outside the user's teams, persist unauthorized project attribution, and retrieve project and customer metadata through GET /api/timesheets/{id}?full=true. TimesheetTeamAccessValidator now checks changed project and activity associations against current team access. This issue is fixed in version 2.57.0.
A vulnerability in Kimai's timesheet API endpoints PATCH /api/timesheets/{id} and POST /api/timesheets prior to version 2.57.0 allows authenticated users to bypass team access restrictions. The issue arises because the API accepts user-supplied project IDs without proper validation, enabling users to assign their timesheets to projects outside their teams. This unauthorized attribution can disrupt project budgets and billing reports. Additionally, users can exploit this vulnerability to access sensitive project and customer metadata through the API.
Users are advised to update Kimai to version 2.57.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kimai/kimai/commit/976d38e8a4485a1c923ee7b5841849e91a06e849 | [email protected] | Source CodeVendor |
| https://github.com/kimai/kimai/pull/5929 | [email protected] | Issue TrackingVendor |
| https://github.com/kimai/kimai/releases/tag/2.57.0 | [email protected] | Release NotesVendor |
| https://github.com/kimai/kimai/security/advisories/GHSA-vrr2-g9gh-c3jc | [email protected] | AdvisoryRemedyVendor |
| https://www.kimai.org/en/security/ghsa-vrr2-g9gh-c3jc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kimai | <= 2.56.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |