Access Control Flaw in Kimai Time Tracking Application
CVE-2026-52825
What is CVE-2026-52825?
The Kimai time tracking application is susceptible to an access control vulnerability that affects team management functionalities. Prior to version 2.58.0, team leads were able to manipulate team memberships and activities without appropriate authorization checks. Specifically, requests to POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} did not properly verify the access permissions for users or the visibility of referenced activities. This oversight allowed team leads to add users or activities that fell outside of their proper management scope, thereby potentially compromising the integrity of team structure and reporting functions. The issue has been rectified in version 2.58.0, making it crucial for users to upgrade to this version to ensure proper access controls are in place.
Affected Version(s)
kimai < 2.58.0