Authorization Bypass in Kimai Time Tracking Application

CVE-2026-52826

What is CVE-2026-52826?

Kimai, the open-source time tracking application, has a vulnerability that allows authenticated users to manipulate billing configurations. Users can send GET or POST requests to specific endpoints without sufficient verification of the relationship between parent objects (such as projects, customers, or activities) and unauthorized rate records. This flaw enables them to pair authorized parent identifiers with child rate identifiers from unauthorized sources, leading to potential misuse and misconfiguration of rates in the billing system. The issue was addressed in version 2.57.0 to enhance the security of the application.

References