CVE-2026-80193: Missing Authorization

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

CVE-2026-80197: Authorization Bypass Through User-Controlled Key

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2026-80202: Incorrect Authorization

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

CVE-2026-80202

Kimai before 2.56.0 has an authorization bypass in TimesheetVoter::voteOnAttribute() , which maps permissions only to own_timesheet or other_timesheet without enforcing team-membership checks. Any authenticated user holding ROLE_TEAMLEAD (or a role with edit_other_timesheet/delete_other_timesheet...

CVE-2026-80197

Kimai before version 2.57.0 is affected by an improper authorization flaw in the favorite timesheet add and remove endpoints. An authenticated user can add or remove timesheet entries from another user's favorite list simply by referencing their timesheet identifier, enabling cross-user business-...

CVE-2026-80197 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2026-80197

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2026-80193

Kimai before 2.62.0 is affected by an authorization bypass in the QuickEntry controller . The root cause is a missing validation of the create_other_timesheet permission when creating new timesheets. Authenticated users who hold only view_other_timesheet and edit_other_timesheet permissions can c...

CVE-2026-80193

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

CVE-2026-80193 Kimai before 2.62.0 Authorization Bypass via QuickEntry

Kimai before 2.62.0 fails to validate createothertimesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with viewothertimesheet and editothertimesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassin...

PT-2026-81906

Kimai before 2.62.0 fails to validate create other timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view other timesheet and edit other timesheet permissions can create timesheet records for team members by submitting the QuickEntry form,...

PT-2026-81910

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

Improper Authorization

Kimai is vulnerable to Improper Authorization. The vulnerability is due to an authorization bypass in the timesheet project assignment logic, where a user-supplied project ID can bypass access restrictions, which allows an authenticated attacker to reassign timesheets to unauthorized projects and...

Improper Authorization

Kimai is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks during the timesheet restart and duplicate workflows, which allows an authenticated user to create new timesheets for projects and activities they are no longer authorized to access...

Authorization Bypass

Kimai is vulnerable to Authorization Bypass. The vulnerability is due to insufficient team-lead authorization checks in the timesheet list API when filtering by user ID, which allows an attacker with viewothertimesheet permission to enumerate other users' timesheet records and disclose sensitive...

GHSA-R8VR-M544-QH4H Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its timesheet state-changing API endpoints. The application reuses the browser's existing session for /api/ requests, and both the stop and restart operations are exposed through GET and PATCH routes that directly...