Kimai
CVE-2026-80202
CRITICAL
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation requires an authenticated teamlead-level role, so PR:L rather than PR:N; network API vector with low complexity and no interaction yields full read, tamper, and permanent-delete of other users' data (C/I/A:H).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team membership. Timesheet IDs are sequential integers and trivially enumerable. ROLE_USER accounts are correctly restricted. (Note: the maintainers characterize this behavior as matching the documented permission model.)
AnalysisAI
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holding ROLE_TEAMLEAD (or any role granting edit_other_timesheet/delete_other_timesheet) read, modify, and permanently delete timesheets belonging to any user system-wide through the REST API, ignoring team boundaries. Because timesheet IDs are sequential integers, an attacker can enumerate and target every record, enabling destruction of billable hours and forgery of payroll/invoicing data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid authenticated Kimai account carrying ROLE_TEAMLEAD, or any role that grants the edit_other_timesheet or delete_other_timesheet permission, and API access (token) to the instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely aligned toward high priority but with one caveat worth calling out. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A disgruntled or compromised employee who holds ROLE_TEAMLEAD authenticates to the API with a valid token, enumerates sequential timesheet IDs (GET /api/timesheets/{id}), and issues DELETE requests to permanently wipe another team's billable hours or PATCH requests to inflate/deflate durations and flip billing flags - directly corrupting invoicing and payroll. A working PoC demonstrating read (HTTP 200), delete (HTTP 204), and tamper (HTTP 200) against Kimai 2.52.0 is published in the advisory. … |
| Remediation | Upgrade to Kimai 2.56.0, which adds the missing team-membership enforcement (Vendor-released patch: 2.56.0); this is the primary and recommended fix per GHSA-9g2q-w3w2-vf7q. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: review timesheet access logs for suspicious activity and restrict team lead role assignments to essential staff. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from a
Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download
Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded inv
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet an
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Rated medium severity (CVSS 6.5), this vu
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today