CVE-2026-52822

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/id/restart, PATCH /api/timesheets/id/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked...

CVE-2026-52822

Kimai , an open-source time tracking application, contains an authorization bypass in its timesheet restart and duplicate workflows (versions prior to 2.58.0 ). The root cause lies in src/Voter/TimesheetVoter.php, where the *_own_timesheet permission is evaluated before current team-based access ...