Kimai Authorization and Authentication Flaws

We need produce JSON object per schema. Need synthesize data. We need read all. Need be careful: Every field plain string, not array. data_quality_flags is array though schema says JSON array? User says every field below must be plain text string, but data_quality_flags is "JSON array of CONCRETE..." Contradiction? It explicitly says Return JSON object with fields and data_quality_flags is array. In PRECISION maybe. Need output valid JSON. So data_quality_flags should be array, not string. But initial "Every field below MUST be a plain text string — NOT an array" might include data_quality_flags? It says data_quality_flags: "JSON array..." Specific overrides? Need likely return array for data_quality_flags. But "Every field below MUST be plain text string"— maybe they expect field as string? It says JSON array, but top says not array. Hmm. We need follow schema: data_quality_flags is array. In prior tasks, data_quality_flags is array. We'll output array. Need ensure other fields strings. Need fill all fields based on data. CVE-2026-52824 Kimai default APP_SECRET in Docker image. Product_name: Kimai (1-3 words). Could be "Kimai" or "Kimai Docker image"? product_name specific product/service, 1-3 words. "Kimai" best. Summary: 2-3 sentence plain-language. Should not copy desc. Start with specific impact verb and product. e.g. "Account takeover in Kimai time-tracking deployments using the official Docker image stems from a static default APP_SECRET..." Mention affected versions <=2.57.0, fixed 2.58.0. PoC publicly available, no KEV, EPSS not provided? Data includes no EPSS, no KEV. Need mention if actively exploited? KEV absent; use "no active exploitation status in CISA KEV" perhaps? Summary should mention if actively exploited (KEV), if POC exists, EPSS risk if notable. EPSS missing. So say "Public exploit/PoC templates exist (Nuclei), but no CISA KEV listing is provided." Need not use forbidden phrase. Could say "Account takeover in Kimai (<=2.57.0) results from

Kimai's REST API accepts the KIMAI_SESSION cookie that is issued after password verification but before the TOTP step, so anyone who knows an account password can obtain fully authenticated API access without ever supplying the second factor. The flaw affects any Kimai instance with two-factor authentication enabled and only benefits attackers who already hold the victim's password, but it defeats the exact protection 2FA is meant to provide. It is fixed in Kimai 2.59.0; a proof-of-concept was submitted with the report but was removed from the public advisory, and no public exploit code is currently identified.

Permission revocation bypass in Kimai's timesheet restart and duplicate workflows allows authenticated users to create new database-persisted time entries under projects they no longer have access to. Affecting Kimai up to and including version 2.57.0, the flaw exists because `TimesheetVoter.php` evaluates the `*_own_timesheet` ownership branch before team-based access checks, meaning a historical timesheet entry acts as a durable capability token that survives administrative revocation. No public exploit is available - a PoC was reportedly submitted to the project and then redacted - and this vulnerability is not listed in CISA KEV.

Improper object-level authorization in Kimai 2.56.0 allows any authenticated user holding the generic `create_activity` permission to inject Activity records into projects outside their authorized scope by directly invoking the preset-project creation routes with an arbitrary project ID. The controllers in `ActivityController.php` and `ProjectController.php` validate only the global capability (can the user create activities at all?) without performing a secondary check that the user also has edit rights on the specific target project. No public exploit exists at time of analysis, though a PoC was privately shared with the vendor and subsequently removed; the vendor has released a fix in version 2.57.0.

Cross-scope billing rate manipulation in Kimai 2.56.0 allows authenticated users with edit access to any single project, customer, or activity to tamper with rate configurations belonging to entirely different organizational units they are not authorized to access. The root cause is missing parent-child consistency validation in three Web admin rate-editing endpoints, where the controller validates the authenticated user's access to the parent object but never verifies that the child rate record actually belongs to that same parent. A PoC was privately submitted and subsequently removed from the advisory before public disclosure; no public exploit code is circulating and no CISA KEV active-exploitation listing exists at time of analysis.

Improper authorization in Kimai's Team API endpoints allows an authenticated Teamlead to add users and activities to their team that fall outside their intended management scope, bypassing the access boundaries enforced by the frontend. Affected versions are Kimai <= 2.57.0 (composer package kimai/kimai). A proof-of-concept was reportedly created but withheld; no public exploit code is currently available and this vulnerability is not listed in CISA KEV. Once a Teamlead writes an out-of-scope team relation, downstream authorization logic may treat those relations as legitimate, silently expanding access to time entries, project visibility, and reporting for the affected users and activities.

Cross-site request forgery in Kimai's timesheet API allows an unauthenticated attacker to trigger unauthorized state changes against any logged-in victim by embedding malicious GET requests in attacker-controlled pages. Kimai versions up to and including 2.57.0 expose the `stop` and `restart` timesheet operations as HTTP GET routes, which browsers will follow automatically using the victim's active session cookie - no CSRF token is required. Impact is limited to timesheet data integrity and availability (corrupted time records, unauthorized entries, billing distortion), not system compromise; no public exploit is confirmed at time of analysis, and no active exploitation has been reported by CISA KEV.

Privilege escalation in Kimai time-tracking software (<=2.57.0) allows authenticated TEAMLEAD users to create and modify global export templates that are intended to be administrator-only resources. The web controller routes `createExportTemplate` and `editExportTemplate` in `ExportController` inherit only the class-level `create_export` permission - granted to ROLE_TEAMLEAD - while the API endpoints and UI correctly enforce the stricter `create_export_template` permission restricted to ROLE_ADMIN and ROLE_SUPER_ADMIN. Because ExportTemplate entities have no per-user or per-team scoping, a TEAMLEAD can silently alter organization-wide export configurations affecting all users including administrators. No public exploit is confirmed at time of analysis, though a private PoC was submitted to the vendor and subsequently removed.