PT-2026-94119

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description For views that utilize state snapshots, the state json snapshot embedded in the client page is restored upon reconnection as trusted view state without an integrity check. This allows a client to modif...

CVE-2026-80197: Authorization Bypass Through User-Controlled Key

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2026-80197

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

PT-2026-57597

Summary Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's timesheet.id can add that record to, or remove it from, the victim's favorite/recent bookmark list. This...