Session Management Vulnerability in Kimai Time Tracking Application

CVE-2026-52823

What is CVE-2026-52823?

The Kimai time tracking application suffers from a session management vulnerability that allows an attacker to exploit exposed API endpoints, specifically GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart. Prior to version 2.58.0, these endpoints fail to implement adequate request validation, allowing an unauthorized user to manipulate timesheet states by making GET requests through compromised content. This could result in the unintended stopping of active timesheets or the restarting of historical entries, leading to potential distortion of time records, billing inaccuracies, and disruption of audit trails. The issue has been rectified in version 2.58.0.

References