CVE-2026-52825

🗓️ 15 Sep 2026 11:17:09Reported by [email protected]Type

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} verify that a teamlead may edit the Team but do not verify access_user for the referenced Us...

Reporter	Title	Published	Views	Family All 9
CVE	CVE-2026-52825	15 Sep 202610:39	–	cve
Cvelist	CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility	15 Sep 202610:39	–	cvelist
EUVD	EUVD-2026-78401	15 Sep 202610:39	–	euvd
Github Security Blog	Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility	14 Jul 202600:09	–	github
OSV	GHSA-XV4R-4885-GWPG Kimai has Improper Authorization in Team Member and Team Activity Assignment APIs Which Allows Expansion of Team Scope Beyond Authorized Visibility	14 Jul 202600:09	–	osv
Positive Technologies	PT-2026-60092	14 Jul 202600:00	–	ptsecurity
Snyk	Missing Authorization	14 Jul 202600:09	–	snyk
Veracode	Missing Authorization	18 Jul 202620:08	–	veracode
Vulnrichment	CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility	15 Sep 202610:39	–	vulnrichment

Source	Link
github	www.github.com/kimai/kimai/pull/5952
github	www.github.com/kimai/kimai/security/advisories/GHSA-xv4r-4885-gwpg
kimai	www.kimai.org/en/security/ghsa-xv4r-4885-gwpg
github	www.github.com/kimai/kimai/releases/tag/2.58.0
github	www.github.com/kimai/kimai/commit/31a8f887a5cda517db7b4320a7ad997c87d08601

15 Sep 2026 13:16Current

CVSS 45.3

EPSS0.00364