Kimai CVE-2026-52823
MEDIUM
GHSA-r8vr-m544-qh4h
Severity by source
Attacker needs no privileges (PR:N) but victim must visit a malicious page (UI:R); impact is confined to timesheet data integrity and stopping active tracking, with no confidentiality impact.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
2DescriptionCVE.org
Summary
Kimai 2.56.0 contains authenticated cross-site request forgery issues in its timesheet state-changing API endpoints. The application reuses the browser's existing session for /api/* requests, and both the stop and restart operations are exposed through GET and PATCH routes that directly modify business state.
As a result, an attacker can trick a logged-in user into visiting a malicious page and cause unauthorized timesheet actions without the victim's consent. Depending on the endpoint, this can stop a running timesheet or create and start a new one from historical data.
Details
The issue affects at least the following API routes:
GET /api/timesheets/{id}/stopGET /api/timesheets/{id}/restart
Both routes are non-read-only operations but are still exposed as GET. In src/API/TimesheetController.php.
*A PoC was provided, but removed for security reasons.*
Impact
This vulnerability allows an attacker to trigger unauthorized business-state changes as a logged-in victim. In the validated stop case, a running timesheet can be stopped, affecting time tracking integrity and potentially availability of ongoing work tracking. In the restart case, a historical timesheet can be restarted and a new record can be created without the victim's knowledge.
These actions can corrupt time records, distort billing and reporting, interfere with approvals or audits, and create persistent database-side side effects. Because exploitation requires only that the victim visit a malicious page while authenticated, the attack barrier is low.
Solution
The GET routes were removed, both stop and restart are only available via PATCH.
See https://www.kimai.org/en/security/ghsa-r8vr-m544-qh4h for more information.
AnalysisAI
Cross-site request forgery in Kimai's timesheet API allows an unauthenticated attacker to trigger unauthorized state changes against any logged-in victim by embedding malicious GET requests in attacker-controlled pages. Kimai versions up to and including 2.57.0 expose the stop and restart timesheet operations as HTTP GET routes, which browsers will follow automatically using the victim's active session cookie - no CSRF token is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be actively authenticated to Kimai with a valid browser session at the time of the attack - unauthenticated users cannot be targeted. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector has been assigned by NVD or the vendor, so all metric assessments are independently inferred from the description and CWE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a Kimai instance accessible to a target employee and embeds an `<img src='https://kimai.company.org/api/timesheets/42/stop'>` tag in a phishing email or malicious website. When the employee opens the page while their Kimai session is active, the browser silently issues a credentialed GET request that stops their running timesheet, causing lost time records or billing discrepancies without any visible indication to the victim. … |
| Remediation | Upgrade Kimai to version 2.58.0 or later; this release removes the vulnerable GET routes for `stop` and `restart`, restricting both operations exclusively to PATCH requests and eliminating the CSRF attack surface by design. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today