Authenticated Cross-Site Request Forgery in Kimai Time Tracking Application
CVE-2026-49992

6.3MEDIUM

Key Information:

Vendor

Kimai

Status
Kimai
Vendor
CVE Published:
11 September 2026

What is CVE-2026-49992?

The Kimai open-source time tracking application is susceptible to authenticated cross-site request forgery issues in its default team creation shortcuts. Versions prior to 2.58.0 expose specific endpoints via GET requests, allowing an attacker to deceive a logged-in user with the correct permissions into accessing a malicious URL. This can lead to unauthorized modifications in team relationships, designating the current user as a team lead, and manipulating bindings with various project objects. This vulnerability compromises the integrity of the application's authorization model. The issue has been resolved in version 2.58.0.

Affected Version(s)

kimai < 2.58.0

References

https://github.com/kimai/kimai/security/advisories/GHSA-p...
x_refsource_CONFIRM
https://www.kimai.org/en/security/ghsa-pgcc-vfmc-7cw5
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.