What is the CVSS score of CVE-2026-40479?

CVE-2026-40479 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40479?

Yes, a patch is available for CVE-2026-40479. Update the affected software to the latest version immediately.

CVE-2026-40479

EUVD-2026-23575 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-15 https://github.com/kimai/kimai

GHSA-g82g-m9vx-vhjg

XSS Privilege Escalation

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 15:06 vuln.today

Analysis Generated

Jul 26, 2026 - 15:06 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 20:30 euvd

EUVD-2026-23575

Patch released

Apr 15, 2026 - 20:30 nvd

Patch available

CVE Published

Apr 15, 2026 - 19:46 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Summary

The client-side escapeForHtml() function in KimaiEscape.js, introduced in commit 89bfa82c (#2959) to fix a JavaScript XSS vulnerability, only escapes <, >, and & but does not escape " (double quote) or ' (single quote). When user-controlled data (profile alias) is placed in an HTML attribute context (title="__DISPLAY__") via the team member form prototype and rendered through innerHTML, the missing quote escaping allows HTML attribute injection, resulting in Stored XSS.

Details

Incomplete security patch. The escapeForHtml() function was meant to prevent XSS but missed quote characters, which are critical for HTML attribute context escaping.

Vulnerable code - assets/js/plugins/KimaiEscape.js:29-33:

javascript

const tagsToReplace = {
    '&': '&amp;',
    '<': '&lt;',
    '>': '&gt;',
    // MISSING: '"': '&quot;'
    // MISSING: "'": '&#039;'
};

Affected code files:

assets/js/plugins/KimaiEscape.js:24-38 - incomplete escape function
assets/js/forms/KimaiTeamForm.js:77,86 - replacement + innerHTML
templates/macros/widgets.html.twig:126 - title="{{ tooltip }}" in avatar macro
templates/form/blocks.html.twig:104 - {{ widgets.avatar('__INITIALS__', '__COLOR__', '__DISPLAY__') }}

PoC

poc.zip

Please extract the uploaded compressed file before proceeding

./setup.sh
./poc_xss.sh

Impact

Stored XSS: payload persists in the database (user alias field)
Privilege escalation: ROLE_USER injects XSS that executes in ROLE_ADMIN/ROLE_SUPER_ADMIN browser session

AnalysisAI

Stored cross-site scripting in Kimai before 2.53.0 allows authenticated low-privilege users to inject JavaScript via the profile alias field. The incomplete escapeForHtml() function fails to escape double and single quotes, enabling HTML attribute injection when the alias is rendered in the team member widget, and leading to privilege escalation if an administrator views the page. Public proof-of-concept code exists, but no active exploitation has been confirmed in the wild.