Kimai CVE-2026-80197

Exploitation requires a valid Kimai account holding the start_own_timesheet permission, which is the default grant for any standard (non-admin) user on a Kimai instance - no elevated or administrative role is needed. The attacker must know or enumerate at least one integer timesheet ID belonging to the victim; Kimai uses sequential integer primary keys, making ID enumeration straightforward against a shared instance. No victim interaction, no special server configuration, and no non-default features are required - the favorites endpoints are standard functionality. Exploitation is inherently bounded to authenticated users of the same Kimai installation; external unauthenticated attackers cannot exploit this flaw without first obtaining credentials. The impact is limited to the favorites/bookmarks feature: core timesheet data, payroll records, and project data are not accessible or modifiable through this vulnerability.

The provided CVSS 4.0 score of 8.7 with VC:H/VI:H/VA:H is materially overstated relative to the actual impact. The GHSA advisory explicitly states 'The issue does not directly disclose sensitive data,' directly contradicting the VC:H (high confidentiality) and VA:H (high availability) ratings - these appear to reflect a worst-case scoring rather than observed impact. The real-world effect is limited to manipulation of a per-user favorites/bookmarks list, which is low-integrity business-state tampering rather than data exfiltration or service disruption. Exploitation requires authentication (PR:L), so the attack surface is confined to users of the same Kimai instance. The IDOR is low-complexity once a victim's timesheet ID is known (sequential integers are trivially enumerable), making insider threat and compromised-account scenarios plausible. EPSS data was not provided. No KEV listing confirms active exploitation. Given the limited blast radius, authentication requirement, and absence of confirmed exploitation, the practical priority for most organizations is low-to-medium, despite the elevated numeric score.

An authenticated Kimai user enumerates another user's timesheet entry IDs - trivial given sequential integer IDs and possible exposure through shared project views - then crafts repeated GET requests to /en/favorite/timemai/add/{victim_id} and /en/favorite/timesheet/remove/{victim_id}, injecting unwanted entries into and purging legitimate entries from the victim's quick-entry favorites workflow. A PoC demonstrating this sequence was submitted to Kimai maintainers during responsible disclosure but was withheld from public release; the attack requires no special tooling beyond an authenticated HTTP client.