Kimai
CVE-2026-80193
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-accessible but requires authenticated low-privilege user; primary impact is integrity (unauthorized record creation); no confidentiality exfiltration or availability impact observed.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
2DescriptionCVE.org
Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.
AnalysisAI
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet and edit_other_timesheet permissions to create timesheet records on behalf of team members without possessing the required create_other_timesheet permission. The missing server-side authorization check (CWE-862) in the QuickEntry submission path enables unauthorized data manipulation across organizational user boundaries within the time-tracking system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Kimai account that has been explicitly granted both view_other_timesheet AND edit_other_timesheet permissions - a combination typically assigned to team leads or managers, not ordinary users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects a straightforward network-accessible flaw exploitable by authenticated users with partial privileges and no attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Kimai team lead holding both view_other_timesheet and edit_other_timesheet permissions submits a crafted QuickEntry form specifying a subordinate's user ID along with arbitrary hours and project codes. The QuickEntry controller processes the request and persists the record without verifying create_other_timesheet permission, resulting in fraudulent or erroneous timesheet entries attributed to the targeted employee. … |
| Remediation | Upgrade to Kimai 2.62.0 or later, which enforces the create_other_timesheet permission check in the QuickEntry controller to close the authorization gap. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Kimai deployments and identify current versions to determine exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holdin
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from a
Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download
Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded inv
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Rated medium severity (CVSS 6.5), this vu
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today