Kimai CVE-2026-80193

Exploitation requires an authenticated Kimai account that has been explicitly granted both view_other_timesheet AND edit_other_timesheet permissions - a combination typically assigned to team leads or managers, not ordinary users. The vulnerable code path is specifically the QuickEntry form submission in the QuickEntry controller; standard per-user timesheet creation paths correctly enforce authorization and are not affected. The attacker must have network access to the Kimai web interface and must be targeting a Kimai instance running a version prior to 2.62.0. Exploitation is inherently limited to internal or semi-trusted users who already hold partial administrative scope over team timesheets, not anonymous external threat actors.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects a straightforward network-accessible flaw exploitable by authenticated users with partial privileges and no attack complexity. However, the official VC:H/VI:H/VA:H impact ratings appear overstated for an authorization bypass whose documented effect is creating timesheet records for team members - the realistic primary impact is data integrity (unauthorized record creation attributed to other users), with limited if any confidentiality exfiltration and no evident availability impact. This discrepancy should be noted when prioritizing patching. EPSS data was not provided, precluding probabilistic exploitation comparison. There is no CISA KEV listing and no known POC, indicating this has not been actively exploited in the wild. Real-world risk is best characterized as moderate: the attacker population is constrained to existing authenticated users who have been explicitly granted both view and edit permissions over other users' timesheets - typically team leads or managers - significantly limiting exposure relative to an unauthenticated or zero-privilege scenario.

An authenticated Kimai team lead holding both view_other_timesheet and edit_other_timesheet permissions submits a crafted QuickEntry form specifying a subordinate's user ID along with arbitrary hours and project codes. The QuickEntry controller processes the request and persists the record without verifying create_other_timesheet permission, resulting in fraudulent or erroneous timesheet entries attributed to the targeted employee. No public exploit code has been identified, and the attack requires no special tooling beyond standard authenticated HTTP form submission.