PT-2026-58990

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its timesheet state-changing API endpoints. The application reuses the browser's existing session for /api/ requests, and both the stop and restart operations are exposed through GET and PATCH routes that directly...

Kimai Security Breach

kimai is a web-based multi-user time tracking application from the individual developer of kimai. A security vulnerability exists in Kimai 2.1.0 and prior versions, which stems from vulnerability to a server-side template injection SSTI attack that can be escalated to Remote Code Execution RCE wh...