Kimai
Monthly
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holding ROLE_TEAMLEAD (or any role granting edit_other_timesheet/delete_other_timesheet) read, modify, and permanently delete timesheets belonging to any user system-wide through the REST API, ignoring team boundaries. Because timesheet IDs are sequential integers, an attacker can enumerate and target every record, enabling destruction of billable hours and forgery of payroll/invoicing data. Publicly available exploit code exists (working API PoC in the GHSA advisory, verified against 2.52.0), though the vulnerability is not listed in CISA KEV and no EPSS score was provided.
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded invoice and export templates, affecting all versions before 2.56.0. An administrator with template upload privileges can craft a malicious template that renders sensitive configuration values - including LDAP bind passwords and SAML SP private keys - directly into invoice or export documents. Those documents are then delivered to lower-privileged users such as team leads who generate them, creating a stealthy credential exfiltration channel. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or remove timesheet entries from another user's favorites list via an IDOR flaw (CWE-639) in the favorite add and remove endpoints. Any account holding the standard `start_own_timesheet` permission can reference another user's timesheet identifier to manipulate their `favorite/recent` workflow state without administrative access. No confirmed active exploitation exists (not in CISA KEV); a PoC was submitted during responsible disclosure but removed before public release. Vendor-released patch is available in version 2.57.0.
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC signature is bound only to the user's database ID, not the password hash. An attacker who obtains an intercepted or cached reset link can authenticate as the victim up to 2 additional times within a 1-hour window even after the victim has changed their password, obtaining a fully authenticated session. A publicly documented proof-of-concept is included in the GHSA advisory; no active exploitation via CISA KEV has been confirmed.
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from any team they can edit by exploiting a non-atomic delete-before-validate workflow in the PATCH /api/teams/{id} endpoint. The endpoint deletes all existing member rows before completing validation of the replacement list; when a malformed payload triggers a validation error, the deletion is not rolled back, leaving teams with no members or teamleaders and collapsing team-based access control. No public exploit has been identified and active exploitation is not confirmed by CISA KEV, but the CVSS 4.0 score of 8.7 and low-privilege attack vector make this a credible insider or compromised-account threat.
Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download the full project overview export via the unprotected `report_project_view_export` route, exposing customer names, project names, currency, budget type, and aggregate totals across all customers. The root cause is a misplaced authorization guard attached to the `__invoke` method on a sibling route rather than at the controller class level, leaving the export route with no access control. No public exploit code has been identified at time of analysis, but the vulnerability is trivially exploitable by any valid Kimai account holder.
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet and edit_other_timesheet permissions to create timesheet records on behalf of team members without possessing the required create_other_timesheet permission. The missing server-side authorization check (CWE-862) in the QuickEntry submission path enables unauthorized data manipulation across organizational user boundaries within the time-tracking system. No public exploit code or active exploitation has been identified; a vendor-released patch is available in Kimai 2.62.0.
Account takeover in Kimai time-tracking software (versions <= 2.57.0) stems from the official Docker image shipping a publicly-known default APP_SECRET ('change_this_to_something_unique') that is used as Symfony's kernel.secret. Any internet-reachable instance deployed from the image without overriding APP_SECRET lets an unauthenticated attacker forge HMAC-signed remember-me cookies, login links, and password-reset URLs to log in as any account, including the super_admin. Publicly available exploit code exists (a Nuclei template), though EPSS remains low at 0.38%.
Authorization bypass in Kimai's REST API timesheet collection endpoint exposes restricted timesheet data to authenticated users lacking team membership. In versions before 2.65.0, users holding the `view_other_timesheet` permission can query the `/api/timesheets` endpoint and retrieve timesheets tied to team-restricted activities, circumventing the intended per-team data isolation model. No public exploit code has been identified and no active exploitation is confirmed, but the flaw is straightforwardly triggered by any authenticated user with the noted permission.
Privilege escalation in Kimai time-tracking (through 2.65.0) allows authenticated users with project permission-management privileges to seize team-lead rights over arbitrary existing teams they do not control. The three team-assignment REST API endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team) silently reuse any existing team whose name matches the resource being configured, then promote the caller to teamlead without verifying they hold authorization over that team - effectively granting them administrative control. Fixed in 2.65.0; no public exploit or CISA KEV listing identified at time of analysis.
Improper authorization in Kimai before 2.63.0 allows authenticated users holding team-edit permissions combined with read-only entity access to modify access control lists for customers, projects, or activities they should not control. The flaw resides in team access endpoints that validate team-edit role but omit a secondary entity-level write authorization check, enabling privilege escalation within the ACL layer via crafted POST requests. The vendor released a fix in version 2.63.0; no public exploit code or active exploitation has been identified at time of analysis.
Insufficient authorization in Kimai's REST API allows authenticated low-privilege users to modify admin-only work-contract preferences on their own account. The WorkContractPreferenceSubscriber, introduced in version 2.61.0, registers employment-contract fields as writable via PATCH /api/users/{id}/preferences without enforcing the contract_other_profile permission check that protects equivalent fields in the web UI. Any authenticated Kimai user on versions 2.61.0 through 2.62.x can tamper with their own work-contract data - a capability reserved for administrators - by calling the API directly. No public exploit has been identified at time of analysis.
Authorization bypass in Kimai before 2.65.0 allows authenticated users holding the edit_team permission to revoke team access to activities, projects, and customers via API endpoints without passing the required permissions_activity check. This breaks Kimai's intended multi-layered permission model, enabling a lower-privileged operator to sever team-level associations to sensitive time-tracking resources they are not authorized to modify. No public exploit code exists and the vulnerability is absent from CISA KEV; a confirmed vendor patch is available in version 2.65.0.
Kimai's Twig invoice template sandbox fails to block the getApiToken() and getPlainApiToken() User methods, allowing admins with template creation permissions to exfiltrate hashed API tokens from any user who generates an invoice using that template. Affected are OnPremise deployments of Kimai before 2.53.0 where invoice template upload is enabled and admins hold the manage_invoice_template permission. No public exploit is independently confirmed, but the GHSA advisory includes complete proof-of-concept reproduction steps; the CVSS 4.0 score of 2.0 reflects the high prerequisite access level and limited confidentiality impact. Note: the 'RCE' tag present in source intelligence appears to be a mis-tag - the vulnerability is information disclosure, not remote code execution.
Open redirect in Kimai's SAML Assertion Consumer Service handler (versions up to and including 2.52.0) enables an attacker with IdP-level access to redirect successfully authenticated users to arbitrary attacker-controlled URLs by supplying a malicious RelayState POST parameter. The vulnerable code in SamlAuthenticationSuccessHandler.php performs no host or scheme validation on the RelayState value - only checking that it does not equal the configured login_path - meaning any fully qualified external URL is accepted as a redirect destination post-SSO. Exploitation is narrowly constrained: SAML must be explicitly enabled (a non-default configuration) and the attacker must control or compromise the IdP; no public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Timing oracle in Kimai's TokenAuthenticator (all 2.x versions before 2.54.0) allows unauthenticated network attackers to enumerate valid usernames by measuring a consistent ~25ms response time differential - argon2id password hashing executes only when a matched user record exists, leaking username validity despite identical HTTP 403 response bodies. No authentication, API token, or session cookie is required to exploit this flaw against default Kimai deployments. A fully functional proof-of-concept Python script is publicly available in the GitHub Security Advisory (GHSA-jrc6-fmhw-fpq2), making this a low-barrier reconnaissance primitive for follow-on credential attacks; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Kimai versions 2.32.0 through 2.55.x allow System-Admin users with invoice template upload permission to read arbitrary files from the PHP server via malicious PDF invoice templates. The vulnerability exploits mPDF's SetAssociatedFiles() function combined with unsanitized Twig template rendering to access any file readable by the PHP worker process and embed it within generated PDF invoices. No public exploit code or active exploitation has been identified; patch available in version 2.56.0.
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user with the TEAMLEAD role to enumerate and read all invoices across the entire system regardless of customer ownership. Public exploit code exists for this authorization bypass vulnerability, which can lead to unauthorized disclosure of sensitive financial and customer data. A patch is available in version 2.51.0 and should be applied immediately.
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users. [CVSS 6.4 MEDIUM]
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that allows authenticated users with export permissions to execute arbitrary method calls and extract sensitive data such as environment variables, password hashes, and session tokens. Public exploit code exists for this vulnerability. The issue is resolved in version 2.46.0 and later.
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Kimai v2 before 1.1 has XSS via a timesheet description. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holding ROLE_TEAMLEAD (or any role granting edit_other_timesheet/delete_other_timesheet) read, modify, and permanently delete timesheets belonging to any user system-wide through the REST API, ignoring team boundaries. Because timesheet IDs are sequential integers, an attacker can enumerate and target every record, enabling destruction of billable hours and forgery of payroll/invoicing data. Publicly available exploit code exists (working API PoC in the GHSA advisory, verified against 2.52.0), though the vulnerability is not listed in CISA KEV and no EPSS score was provided.
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded invoice and export templates, affecting all versions before 2.56.0. An administrator with template upload privileges can craft a malicious template that renders sensitive configuration values - including LDAP bind passwords and SAML SP private keys - directly into invoice or export documents. Those documents are then delivered to lower-privileged users such as team leads who generate them, creating a stealthy credential exfiltration channel. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or remove timesheet entries from another user's favorites list via an IDOR flaw (CWE-639) in the favorite add and remove endpoints. Any account holding the standard `start_own_timesheet` permission can reference another user's timesheet identifier to manipulate their `favorite/recent` workflow state without administrative access. No confirmed active exploitation exists (not in CISA KEV); a PoC was submitted during responsible disclosure but removed before public release. Vendor-released patch is available in version 2.57.0.
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC signature is bound only to the user's database ID, not the password hash. An attacker who obtains an intercepted or cached reset link can authenticate as the victim up to 2 additional times within a 1-hour window even after the victim has changed their password, obtaining a fully authenticated session. A publicly documented proof-of-concept is included in the GHSA advisory; no active exploitation via CISA KEV has been confirmed.
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from any team they can edit by exploiting a non-atomic delete-before-validate workflow in the PATCH /api/teams/{id} endpoint. The endpoint deletes all existing member rows before completing validation of the replacement list; when a malformed payload triggers a validation error, the deletion is not rolled back, leaving teams with no members or teamleaders and collapsing team-based access control. No public exploit has been identified and active exploitation is not confirmed by CISA KEV, but the CVSS 4.0 score of 8.7 and low-privilege attack vector make this a credible insider or compromised-account threat.
Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download the full project overview export via the unprotected `report_project_view_export` route, exposing customer names, project names, currency, budget type, and aggregate totals across all customers. The root cause is a misplaced authorization guard attached to the `__invoke` method on a sibling route rather than at the controller class level, leaving the export route with no access control. No public exploit code has been identified at time of analysis, but the vulnerability is trivially exploitable by any valid Kimai account holder.
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet and edit_other_timesheet permissions to create timesheet records on behalf of team members without possessing the required create_other_timesheet permission. The missing server-side authorization check (CWE-862) in the QuickEntry submission path enables unauthorized data manipulation across organizational user boundaries within the time-tracking system. No public exploit code or active exploitation has been identified; a vendor-released patch is available in Kimai 2.62.0.
Account takeover in Kimai time-tracking software (versions <= 2.57.0) stems from the official Docker image shipping a publicly-known default APP_SECRET ('change_this_to_something_unique') that is used as Symfony's kernel.secret. Any internet-reachable instance deployed from the image without overriding APP_SECRET lets an unauthenticated attacker forge HMAC-signed remember-me cookies, login links, and password-reset URLs to log in as any account, including the super_admin. Publicly available exploit code exists (a Nuclei template), though EPSS remains low at 0.38%.
Authorization bypass in Kimai's REST API timesheet collection endpoint exposes restricted timesheet data to authenticated users lacking team membership. In versions before 2.65.0, users holding the `view_other_timesheet` permission can query the `/api/timesheets` endpoint and retrieve timesheets tied to team-restricted activities, circumventing the intended per-team data isolation model. No public exploit code has been identified and no active exploitation is confirmed, but the flaw is straightforwardly triggered by any authenticated user with the noted permission.
Privilege escalation in Kimai time-tracking (through 2.65.0) allows authenticated users with project permission-management privileges to seize team-lead rights over arbitrary existing teams they do not control. The three team-assignment REST API endpoints (POST /api/customers/{id}/team, POST /api/projects/{id}/team, POST /api/activities/{id}/team) silently reuse any existing team whose name matches the resource being configured, then promote the caller to teamlead without verifying they hold authorization over that team - effectively granting them administrative control. Fixed in 2.65.0; no public exploit or CISA KEV listing identified at time of analysis.
Improper authorization in Kimai before 2.63.0 allows authenticated users holding team-edit permissions combined with read-only entity access to modify access control lists for customers, projects, or activities they should not control. The flaw resides in team access endpoints that validate team-edit role but omit a secondary entity-level write authorization check, enabling privilege escalation within the ACL layer via crafted POST requests. The vendor released a fix in version 2.63.0; no public exploit code or active exploitation has been identified at time of analysis.
Insufficient authorization in Kimai's REST API allows authenticated low-privilege users to modify admin-only work-contract preferences on their own account. The WorkContractPreferenceSubscriber, introduced in version 2.61.0, registers employment-contract fields as writable via PATCH /api/users/{id}/preferences without enforcing the contract_other_profile permission check that protects equivalent fields in the web UI. Any authenticated Kimai user on versions 2.61.0 through 2.62.x can tamper with their own work-contract data - a capability reserved for administrators - by calling the API directly. No public exploit has been identified at time of analysis.
Authorization bypass in Kimai before 2.65.0 allows authenticated users holding the edit_team permission to revoke team access to activities, projects, and customers via API endpoints without passing the required permissions_activity check. This breaks Kimai's intended multi-layered permission model, enabling a lower-privileged operator to sever team-level associations to sensitive time-tracking resources they are not authorized to modify. No public exploit code exists and the vulnerability is absent from CISA KEV; a confirmed vendor patch is available in version 2.65.0.
Kimai's Twig invoice template sandbox fails to block the getApiToken() and getPlainApiToken() User methods, allowing admins with template creation permissions to exfiltrate hashed API tokens from any user who generates an invoice using that template. Affected are OnPremise deployments of Kimai before 2.53.0 where invoice template upload is enabled and admins hold the manage_invoice_template permission. No public exploit is independently confirmed, but the GHSA advisory includes complete proof-of-concept reproduction steps; the CVSS 4.0 score of 2.0 reflects the high prerequisite access level and limited confidentiality impact. Note: the 'RCE' tag present in source intelligence appears to be a mis-tag - the vulnerability is information disclosure, not remote code execution.
Open redirect in Kimai's SAML Assertion Consumer Service handler (versions up to and including 2.52.0) enables an attacker with IdP-level access to redirect successfully authenticated users to arbitrary attacker-controlled URLs by supplying a malicious RelayState POST parameter. The vulnerable code in SamlAuthenticationSuccessHandler.php performs no host or scheme validation on the RelayState value - only checking that it does not equal the configured login_path - meaning any fully qualified external URL is accepted as a redirect destination post-SSO. Exploitation is narrowly constrained: SAML must be explicitly enabled (a non-default configuration) and the attacker must control or compromise the IdP; no public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Timing oracle in Kimai's TokenAuthenticator (all 2.x versions before 2.54.0) allows unauthenticated network attackers to enumerate valid usernames by measuring a consistent ~25ms response time differential - argon2id password hashing executes only when a matched user record exists, leaking username validity despite identical HTTP 403 response bodies. No authentication, API token, or session cookie is required to exploit this flaw against default Kimai deployments. A fully functional proof-of-concept Python script is publicly available in the GitHub Security Advisory (GHSA-jrc6-fmhw-fpq2), making this a low-barrier reconnaissance primitive for follow-on credential attacks; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Kimai versions 2.32.0 through 2.55.x allow System-Admin users with invoice template upload permission to read arbitrary files from the PHP server via malicious PDF invoice templates. The vulnerability exploits mPDF's SetAssociatedFiles() function combined with unsanitized Twig template rendering to access any file readable by the PHP worker process and embed it within generated PDF invoices. No public exploit code or active exploitation has been identified; patch available in version 2.56.0.
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user with the TEAMLEAD role to enumerate and read all invoices across the entire system regardless of customer ownership. Public exploit code exists for this authorization bypass vulnerability, which can lead to unauthorized disclosure of sensitive financial and customer data. A patch is available in version 2.51.0 and should be applied immediately.
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users. [CVSS 6.4 MEDIUM]
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that allows authenticated users with export permissions to execute arbitrary method calls and extract sensitive data such as environment variables, password hashes, and session tokens. Public exploit code exists for this vulnerability. The issue is resolved in version 2.46.0 and later.
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Kimai v2 before 1.1 has XSS via a timesheet description. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.