CVE-2026-52821

Kimai , an open-source time tracking application, is affected by an improper authorization flaw in its preset-parent creation flow prior to version 2.57.0 . In ActivityController.php and ProjectController.php, the controllers check only the generic create_activity or create_project capability but...

CVE-2026-52821: Authorization Bypass Through User-Controlled Key

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/project and /en/admin/project/create/customer require only the generic createactivity or createproject capability and do not verify edit access to the supplied Project or Customer...

Cross-Site Request Forgery (CSRF)

kevinpapst/kimai2 is vulnerable to cross-site request forgery. An attacker can add admin users to duplicate teams through the duplicateAction function in ProjectController.php...