Skip to main content

Kimai CVE-2026-80197

HIGH
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-08-25 VulnCheck
Authentication Bypass Kimai
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-accessible IDOR requiring authentication (PR:L); impact is limited to low integrity on favorites state with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 26, 2026 - 00:05 vuln.today
Analysis Generated
Aug 26, 2026 - 00:05 vuln.today
CVE Published
Aug 25, 2026 - 23:19 cve.org
HIGH 8.7

DescriptionCVE.org

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their timesheet identifier, enabling cross-user business-state tampering without administrative privileges.

AnalysisAI

Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or remove timesheet entries from another user's favorites list via an IDOR flaw (CWE-639) in the favorite add and remove endpoints. Any account holding the standard start_own_timesheet permission can reference another user's timesheet identifier to manipulate their favorite/recent workflow state without administrative access. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as low-privileged Kimai user
Delivery
Enumerate victim's timesheet integer IDs via shared views or sequential guessing
Exploit
Craft GET request to /en/favorite/timesheet/add/{victim_id}
Execution
Authorization check passes (only start_own_timesheet verified)
Persist
Victim's bookmark list modified without consent
Impact
Repeat add/remove to persistently disrupt victim's workflow
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid Kimai account holding the `start_own_timesheet` permission, which is the default grant for any standard (non-admin) user on a Kimai instance - no elevated or administrative role is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 score of 8.7 with VC:H/VI:H/VA:H is materially overstated relative to the actual impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated Kimai user enumerates another user's timesheet entry IDs - trivial given sequential integer IDs and possible exposure through shared project views - then crafts repeated GET requests to `/en/favorite/timemai/add/{victim_id}` and `/en/favorite/timesheet/remove/{victim_id}`, injecting unwanted entries into and purging legitimate entries from the victim's quick-entry favorites workflow. A PoC demonstrating this sequence was submitted to Kimai maintainers during responsible disclosure but was withheld from public release; the attack requires no special tooling beyond an authenticated HTTP client.
Remediation Upgrade to Kimai 2.57.0 or later; this is the vendor-released patch (composer package `kimai/kimai`, fixed in 2.57.0) that corrects the authorization logic so bookmark ownership is derived from the authenticated session user rather than the referenced Timesheet object's owner. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Kimai deployments and confirm current versions are earlier than 2.57.0, then restrict elevated timesheet modification permissions to supervisory roles only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Kimai

View all
CVE-2023-46245 HIGH POC
7.2 Oct 31

Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel
CVE-2026-23626 MEDIUM POC
6.8 Jan 18

Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that

CVE-2026-28685 MEDIUM POC
6.5 Mar 06

Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user
CVE-2024-29200 MEDIUM POC
6.5 Mar 28

Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot
CVE-2019-25317 MEDIUM POC
6.4 Feb 11

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into

CVE-2026-80202 CRITICAL
9.3 Aug 25

Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holdin
CVE-2026-80196 HIGH
8.7 Aug 25

Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC
CVE-2026-80195 HIGH
8.7 Aug 25

Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from a
CVE-2026-80194 HIGH
8.7 Aug 25

Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download
CVE-2026-80198 HIGH
8.7 Aug 25

Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded inv
CVE-2026-80193 HIGH
8.7 Aug 25

Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet an
CVE-2024-4596 MEDIUM
6.5 May 07

A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Rated medium severity (CVSS 6.5), this vu

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-80197 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy