Authorization Bypass in Kimai Time Tracking Application by Vendor

CVE-2026-52820

What is CVE-2026-52820?

The Kimai time tracking application, prior to version 2.57.0, suffers from an authorization bypass vulnerability. Through the PATCH /api/timesheets/{id} and POST /api/timesheets endpoints, an authenticated user can specify a project identifier that bypasses team access restrictions. This flaw enables users with permission to edit their own timesheets to associate them with projects outside their authorized teams. The result is unauthorized project attribution and potential exposure of sensitive project and customer metadata via API calls. This issue has been rectified in version 2.57.0, where the TimesheetTeamAccessValidator now properly validates project and activity associations against user team access.

References