EUVD-2026-69917
GHSA-785m-wqjq-q2rm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API, no complexity; PR:L because a valid user session is required; integrity limited to self-modification of work-contract fields only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.
AnalysisAI
Insufficient authorization in Kimai's REST API allows authenticated low-privilege users to modify admin-only work-contract preferences on their own account. The WorkContractPreferenceSubscriber, introduced in version 2.61.0, registers employment-contract fields as writable via PATCH /api/users/{id}/preferences without enforcing the contract_other_profile permission check that protects equivalent fields in the web UI. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Kimai user account (any role below admin) on an instance running versions 2.61.0 through 2.62.x. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) reflects a moderate risk: the attack is trivially network-accessible with no complexity, but requires an authenticated session (PR:L) and yields only limited integrity impact (VI:L) - specifically self-modification of work-contract fields, not lateral access to other users' data or system-wide integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Kimai 2.63.0, which applies the contract_other_profile permission check to the PATCH /api/users/{id}/preferences API endpoint, closing the discrepancy with the web UI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Account takeover in Kimai time-tracking software (versions <= 2.57.0) stems from the official Docker image shipping a pu
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated crit
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remot
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remot
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holdin
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet an
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today